I recently installed aws-vault on my old iMac, for malware hardening. If any finds me, I don’t want it to be able to pick up ~/.aws/credentials and start mining cryptocurrency.
One problem: there were a lot of password prompts, and the “aws-vault” keychain did not appear in Keychain Access as promised.
But it’s okay; there’s a security command that works with it, if we know the secret internal name of the keychain: aws-vault.keychain-db. (I found this by looking in my ~/Library directory for the keychains; most of them have several files, but aws-vault has only that one.)
As in:
security show-keychain-info aws-vault.keychain-dbsecurity set-keychain-settings -l -u -t 900 aws-vault.keychain-dbsecurity lock-keychain aws-vault.keychain-dbsecurity set-keychain-password aws-vault.keychain-db(this will prompt for current and new passwords)
Regarding the set-keychain-settings subcommand. Each option specifies a setting: -l to lock the keychain whenever the screen is locked, -u to lock the keychain after a time period, and -t {seconds} to set that time period. So, in the example, we are setting the keychain to lock again after 900 seconds. There do not seem to be opposites of these options documented, so I would guess running the command without a flag will remove that option. I haven’t tested that, though.
I added the lock-keychain subcommand to my logout file [~/.zlogout for zsh, but formerly ~/.bash_logout]. Whenever I exit an iTerm2 tab, everything is locked again. (I’ve been clearing SSH keys from the agent in that file for a long time.)
I’ve chosen to “Always Allow” aws-vault to access the keychain, which means I need to put in the password only for the unlocking operation, not for every time the binary wants to access information within the keychain.
