KeePass: an MFA TOTP codes, a browser’s passwords, SSH keys passwords storage configuration and Secret Service integration
Tags: linux, security, tutorial
Published: 2019-12-12 13:13:11

---
title: KeePass: an MFA TOTP codes, a browser’s passwords, SSH keys passwords storage configuration and Secret Service integration
published: true
date: 2019-12-12 11:23:38 UTC
tags: Linux,Security,tutorial
canonical_url: https://rtfm.co.ua/en/keepass-an-mfa-totp-codes-a-browsers-passwords-ssh-keys-passwords-storage-configuration-and-secret-service-integration/
---

![](https://rtfm.co.ua/wp-content/uploads/2019/12/keepass-logo.png)So, this seems to be the last one post in the whole series about passwords and SSH management in Linux.

The previous parts were about:

- [Linux: the Nextcloud client, qtkeychain and the “The name org.freedesktop.secrets was not provided by any .service files” error](https://rtfm.co.ua/en/linux-the-nextcloud-client-qtkeychain-and-the-the-name-org-freedesktop-secrets-was-not-provided-by-any-service-files-error/)  
– I found that a keyring service is able to store SSH keys passwords  
– and got to know that Chromium stores passwords in an “unencrypted way”
- [Linux: KeePass, SSH и хранение паролей RSA-ключей](https://rtfm.co.ua/linux-keepass-ssh-i-xranenie-parolej-rsa-klyuchej/) (_in Russian yet, to be translated soon_)  
– how to work with the `ssh-agent`, a bit about its integration with KeePass to store SSH keys passwords
- [What is: Linux keyring, gnome-keyring, Secret Service, and D-Bus](https://rtfm.co.ua/en/what-is-linux-keyring-gnome-keyring-secret-service-and-d-bus/)  
– what is a keyring and how to work with it  
– recalled, how to work with D-Bus  
– and a couple of words about KeePass integration as a Secret Service
- [Chromium: Linux, keyrings && Secret Service, passwords encryption and store](https://rtfm.co.ua/en/chromium-linux-keyrings-secret-service-passwords-encryption-and-store/)  
– and finally sorted out – is it true, that Chromium stores sensitive data in a plaintext?

Actually, knowing all of this we can grab them all together and configure normal secrets management on a work laptop with Arch Linux and Openbox DE.

In this post we will configure KeePassXC for:

- a browser integration to store passwords in the KeePass instead of the Chromium’s own SQLite database
- TOTP codes generation for MFA
- will integrate the `ssh-agent` with KeePass to store RSA keys passwords
- and will enable Secret Service integration to use KeePass as keyring storage for Linux

### Contents

- [KeePass vs KeePassXC] (https://rtfm.co.ua/en/keepass-an-mfa-totp-codes-a-browsers-passwords-ssh-keys-passwords-storage-configuration-and-secret-service-integration/#KeePass_vs_KeePassXC)
- [KeePass and a browser’s passwords – KeePassXC-Browser] (https://rtfm.co.ua/en/keepass-an-mfa-totp-codes-a-browsers-passwords-ssh-keys-passwords-storage-configuration-and-secret-service-integration/#KeePass_and_a_browsers_passwords_KeePassXC-Browser)
- [KeePassXC MFA TOTP generator] (https://rtfm.co.ua/en/keepass-an-mfa-totp-codes-a-browsers-passwords-ssh-keys-passwords-storage-configuration-and-secret-service-integration/#KeePassXC_MFA_TOTP_generator)
- [KeePass and ssh-agent for SSH keys passwords] (https://rtfm.co.ua/en/keepass-an-mfa-totp-codes-a-browsers-passwords-ssh-keys-passwords-storage-configuration-and-secret-service-integration/#KeePass_and_ssh-agent_for_SSH_keys_passwords)
- [sign_and_send_pubkey: signing failed: agent refused operation] (https://rtfm.co.ua/en/keepass-an-mfa-totp-codes-a-browsers-passwords-ssh-keys-passwords-storage-configuration-and-secret-service-integration/#sign_and_send_pubkey_signing_failed_agent_refused_operation)
- [KeePass and Secret Service integration] (https://rtfm.co.ua/en/keepass-an-mfa-totp-codes-a-browsers-passwords-ssh-keys-passwords-storage-configuration-and-secret-service-integration/#KeePass_and_Secret_Service_integration)

### KeePass vs KeePassXC

I’ll use KeePassXC instead of the KeePass.

In fact, from the very beginning, I switched to the KeePassXC just because by default it looks much better in Linux with Openbox.

KeePass:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_092552.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_092552.png)

KeePassXC:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_092630.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_092630.png)

Also, KeePass is written in C# from Microsoft and under Linux requires [`mono`](https://www.mono-project.com/docs/about-mono/supported-platforms/linux/) to work, while KeePassXC is written in C++ (see its [repository](https://github.com/keepassxreboot/keepassxc)) and work in easy on any platform – Linux/BSD/macOS/Windows.

Take a look at the thread on [Reddit](https://www.reddit.com/r/KeePass/comments/8wll8p/keepass_vs_keepassxc/) for more details.

As a browser, I’ll use Brave based on the Chromium so there will no difference in a configuration.

### KeePass and a browser’s passwords – KeePassXC-Browser

At first, there is a good question – do you really want to switch passwords storage for your browser?

I.e, you have Chromium, it has its own SQLite database, passwords stored there in [an encrypted way](https://rtfm.co.ua/en/chromium-linux-keyrings-secret-service-passwords-encryption-and-store/#Summary).

Furthermore, Chromium has no issue with founding credential fields on webpages, but this happens sometimes with KeePass.

On the other hand, when using KeePass – all your passwords (and SSH keys, etc) are always with you, in the same place. Easy to backup/restore, move/share between computers, add to another browser and so on.

So, everybody will decide this himself, but let’s write the KeePass and Chromium integration process.

Go to the _Tools > Settings_, then to the _Browser Integration_, enable it:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_093348.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_093348.png)

Find the **KeePassXC-Browser** plugin, install it:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_085937.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_085937.png)

Go to the _Settings_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_093139.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_093139.png)

- _Default group for saving new passwords_ – usually, I’m disabling the default KeePassXC-Browser Passwords and enabling this option to be always asked where I’d like to save a new password as in my database everything is divided over groups
- _Activate 2FA/OTP field icons_ – can enable if actively using MFA, but is it worth to do it? See the _[KeePass MFA TOTP generator](https://rtfm.co.ua/?p=22933#KeePass_MFA_TOTP_generator "KeePass MFA TOTP generator") below_
- _Automatically reconnect to KeePassXC_ – comfortable to always stay connected to the database, didn’t saw any lags/bugs yet
- _Automatically fill in HTTP Basic Auth dialogs and submit them_ – looks useful, but I wasn’t able to make it works – an HTTP-form window always was displayed

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_093917.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_093917.png)

Go back to the plugin, click _Connect_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_094420.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_094420.png)

Set a connection name:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_094504.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_094504.png)

Check KeePass about connected browsers:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_114218.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_114218.png)

And it’s done – the icon is green now:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_094800.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_094800.png)

Log in somewhere and KeePass will prompt to save the password:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_095246.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_095246.png)

Save it (_New_), log in again – and our credentials are here now:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_095117.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_095117.png)

### KeePassXC MFA TOTP generator

One more interesting thing – TOTP codes generator in the KeePassXC.

Still, there is a serious question: is it a good solution to enable it?

The main idea behind the MFA authentication is exactly to use two separate services to authenticate you, i.e. _login:password_ from the one side, **and** a TOTP-code from your MFA on another.

Is it worth to keep them together in the same KeePass database – absolutely about you, but keep in mind that if somebody will get access to your KeePass – then you’ll have no chance for the MFA as the last hope to keep your data secure.

Still, such an option is present, I’m using MFA, so let’s take a look at how to configure it.

During an MFA configuration – chose something like “_Show secret key_” or “_Can’t scan QR_“, depending on a service, to see a text code instead of QR code.

Here is an example from the AWS Console:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_100526.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_100526.png)

Save the code, then in your KeePassXC find or update an entry you’d like to configure MFA for, right-click on it – _TOTP > Set up TOTP_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_100828.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_100828.png)

And set the _Secret Key_ from AWS:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_101210.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_101210.png)

Save, right-click again – _Show TOTP_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_101352.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_101352.png)

And finish MFA configuration in AWS:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_101446.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_101446.png)

Try to log in, but… The button to fill up the TOTP field doesn’t works ![🙁](https://s.w.org/images/core/emoji/12.0.0-1/72x72/1f641.png)

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_101858.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_101858.png)And it didn’t work in Chromium for Gmail too.

Well – the code in the KeePass is generated, so just manually copy it by right click or by using _Ctrl+T_ – and we are done here.

### KeePass and `ssh-agent` for SSH keys passwords

The idea here is to store SSH keys passwords in the KeePass, and access them via `ssh-agent` without being asked for a SSH-key password.

It is already described in more details in the [Linux: KeePass, SSH и хранение паролей RSA-ключей](https://rtfm.co.ua/linux-keepass-ssh-i-xranenie-parolej-rsa-klyuchej/) post, but it’s available in Russin only at this moment (will translate it in next couple of days).

Check if `ssh-agent` is running:

```
$ ps aux | grep ssh-agent
setevoy     1505  0.0  0.0   5796   456 ?        Ss   Dec10   0:00 ssh-agent
```

If no – start it:

```
$ eval $(ssh-agent)
Agent pid 950428
```

Check if the `$SSH_AUTH_SOCK` variable is available, as it will point to a socket used for communication with the agent:

```
$ env | grep SSH
SSH\_AUTH\_SOCK=SSH\_AUTH\_SOCK=/run/user/1000/ssh-agent.socket
SSH\_AGENT\_PID=950428
```

Go to KeePass _Tools > Settings_, enable _SSH Agent_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_103342.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_103342.png)

Restart KeePass and add a new key.

Generate it, set a password:

```
$ ssh-keygen -f /home/setevoy/rtfm-do-prod-setevoy
Generating public/private rsa key pair.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/setevoy/rtfm-do-prod-setevoy.
Your public key has been saved in /home/setevoy/rtfm-do-prod-setevoy.pub.
...
```

Pay attention that here is the `-f` used to set a key-file and it is not in the `.ssh` directory to make it simpler to add to the KeePass.

Check files:

```
$ ll /home/setevoy/rtfm-do-prod-setevoy\*
-rw------- 1 setevoy setevoy 2655 Dec 11 10:53 /home/setevoy/rtfm-do-prod-setevoy
-rw-r--r-- 1 setevoy setevoy  579 Dec 11 10:53 /home/setevoy/rtfm-do-prod-setevoy.pub
```

Go back to the KeePass, create a new entry, set any name, and set your key’s password in the _Password_ field:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_105521.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_105521.png)

In the _SSH Agent,_ a key can be added as _Attachment_, or as _External file_.

I’d suggest using _Attachment_ as in this case the key will be stored in the database directly, and you’ll not need to copy it over your working/home/etc laptops.

In the same window switch to the _Advanced_, tab and attach the key file:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_110048.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_110048.png)

Go to the _SSH Agent_, add the key from the _Attachment_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_111035.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_111035.png)

Here, pay attention to the _Add key to agent when database is opened/unlocked_ option – worth to enable it only for keys that are used often and best to keep them less than 5, because when ssh-agent will try to connect to a host – it will try to use every key accessible in the `ssh-agent`, and SSH server on a remote host can close connection to “prevent a brute-force”.

Okay, try to connect to a host:

```
$ ssh setevoy@rtfm.co.ua
Linux rtfm-do-production 4.9.0-8-amd64 #1 SMP Debian 4.9.144-3.1 (2019-02-19) x86\_64
...
setevoy@rtfm-do-production:~$
```

Okay – it works.

Remember, that using this approach `ssh-agent` must be started beforehand of the KeePass and must export its `$SSH_AUTH_SOCK` variable in such a way, so KeePass can see it. Check options in the [Running ssh-agent with multitype terminals](https://rtfm.co.ua/en/ssh-rsa-keys-and-ssh-agent-for-ssh-keys-and-their-passwords-management/#Running_ssh-agent_with_multitype_terminals).

I’m using the variant with the `systemd` service and the socket path will be exported via the `~/.config/openbox/environment` file (as I’m using Openbox DE).

My unit-file `/home/setevoy/.config/systemd/user/ssh-agent.service`:

```
[Unit]
Description=SSH key agent
[Service]
Type=simple
Environment=SSH_AUTH_SOCK=%t/ssh-agent.socket
ExecStart=/usr/bin/ssh-agent -D -a $SSH_AUTH_SOCK
[Install]
WantedBy=default.target
```

And environment file – `~/.config/openbox/environment`:

```
export QT_QPA_PLATFORMTHEME="qt5ct"
export SSH_AUTH_SOCK="${XDG_RUNTIME_DIR}/ssh-agent.socket"
```

The last step just for a bit of comfort – add a “short-name” for the connection to the `~/.ssh/config`:

```
Host rtfm
 Hostname rtfm.co.ua
 User setevoy
```

We are not adding `IdentityFile` at all – `ssh-client` will ask for `ssh-agent` about available keys to try to log in, so we are not tied to a key-file on the disk.

Connect now using this short-name:

```
$ ssh rtfm
...
setevoy@rtfm-do-production:~$
```

Passwords were asked neither for the user nor for the key – everything is working, as expected.

#### sign\_and\_send\_pubkey: signing failed: agent refused operation

A short side-note: if you’ll enable the “_Require user confirmation when this key is used_” option now:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_163937.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_163937.png)

Then during SSH logging in process, sometimes you can see the “_sign\_and\_send\_pubkey: signing failed: agent refused operation_” error:

```
$ ssh rtfm
sign\_and\_send\_pubkey: signing failed: agent refused operation
Load key "/home/setevoy/.ssh/id\_rsa": Is a directory
setevoy@rtfm.co.ua's password:
```

It happens because `ssh-agent` trying to ask a user for confirmation and uses the `ssh-askpass` utility which can be not installed in  a system:

```
$ file /usr/lib/ssh/ssh-askpass
/usr/lib/ssh/ssh-askpass: cannot open `/usr/lib/ssh/ssh-askpass' (No such file or directory)
```

Install the `x11-ssh-askpass` package:

```
$ sudo pacman -S x11-ssh-askpass
```

Re-try log in – and now you must see such a window with confirmation request:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_164655.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_164655.png)

Click on the _ОК_ – and now all works.

### KeePass and Secret Service integration

For a better understanding of keyrings in general and the Secret Service in particular cases – I’d strongly recommend you first to read the [What is: Linux keyring, gnome-keyring, Secret Service, and D-Bus](https://rtfm.co.ua/en/what-is-linux-keyring-gnome-keyring-secret-service-and-d-bus/) post.

At a first, let’s make sure we have no Secret Service available in our system – check the D-Bus:

```
$ qdbus --session org.freedesktop.DBus / org.freedesktop.DBus.GetConnectionUnixProcessID org.freedesktop.secrets
Error: org.freedesktop.DBus.Error.NameHasNoOwner
Could not get PID of name 'org.freedesktop.secrets': no such name
```

Okay, it’s empty.

Go to the KeePass, _Tools > Settings_, choose the _Secret Service Integration_, enable it:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_113252.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_113252.png)

Now, go to the KeePass database’s settings, and in its _Secret Service Integration_ settings specify a collection (team, folder) which will be used to store our secrets:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_114139.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_114139.png)

Also, it’s a good idea now to start KeePass beforehand every other application in the system.

In my case, this can be done with the `~/.config/openbox/autostart` file:

```
xrandr --output HDMI-1 --primary
xrandr --output eDP-1 --right-of DP-1
feh --bg-scale /home/setevoy/Pictures/Wallpaper/seryy-kapli-strela-ten-arch.jpg &
tint2 -c /home/setevoy/.config/tint2/setevoy-tint2-90-pecent-bottom-wrk.tint2rc &
polybar -c /home/setevoy/.config/polybar/setevoy-polybar-wrk-bars.conf bottom &
polybar -c /home/setevoy/.config/polybar/setevoy-polybar-wrk-bars.conf top &
sleep 5
keepassxc &
dropbox &
lxqt-notificationd &
xscreensaver &
qxkb &
skypeforlinux &
sleep 5
slack &
...
```

Run a browser:

```
$ chromium --password-store=gnome
```

And in the KeePass’ _Tools > Settings_ check services which are using Secret Service now:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_125012.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_125012.png)

A notification from the KeePass when Chromium tries to access its password to decrypt some passwords in its SQLite database:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_125346.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_125346.png)

But here is another issue: when I’m starting Chromium via [`gmrun`](https://rtfm.co.ua/arch-posleustanovochnye-nastrojki/#Openbox_XOrg) – it’s started with the `--password-store=basic` instead of the `--password-store=gnome`, although it has to check if a Secret Service is available and run “gnome” instead of the “basic” storage.

To salve it – read the [Arch Wiki](https://wiki.archlinux.org/index.php/Chromium/Tips_and_tricks#Making_flags_persistent) and create a `~/.config/chromium-flags.conf` file:

```
--password-store=gnome
```

Restart the browser, go to the [chrome://version/](chrome://version/), and check options:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_131330.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_131330.png)

Okay, it worked for the Chromium – but Brave still uses the “_basic_” option.

For the Brave browser in Arch Linux, you can create a `~/.config/brave-flags.conf` file, as mentioned in [this>>>](https://github.com/brave/brave-browser/issues/2300#issuecomment-504907440) comment, so we can just to copy the existing one:

```
$ cp .config/chromium-flags.conf .config/brave-flags.conf
```

Restart Brave, check its options:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_132258.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_132258.png)

And in the Secret Service of the KeePass, the _brave_ record appeared, so it’s using the Secret Service now:

[![](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_133546.png "KeePass: настройка MFA TOTP, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service")](https://rtfm.co.ua/wp-content/uploads/2019/12/Screenshot_20191211_133546.png)

Done.

### Similar posts

- <small>12/11/2019</small> [KeePass: настройка MFA, хранение паролей браузера, паролей SSH ключей и интеграция Secret Service](https://rtfm.co.ua/keepass-nastrojka-mfa-xranenie-parolej-brauzera-parolej-ssh-klyuchej-i-integraciya-secret-service/) 
- <small>12/01/2019</small> [SSH: RSA keys, and ssh-agent for SSH keys and their passwords management](https://rtfm.co.ua/en/ssh-rsa-keys-and-ssh-agent-for-ssh-keys-and-their-passwords-management/)  
- <small>12/07/2019</small> [What is: Linux keyring, gnome-keyring, Secret Service, and D-Bus](https://rtfm.co.ua/en/what-is-linux-keyring-gnome-keyring-secret-service-and-d-bus/) 
- <small>12/01/2019</small> [Linux: the Nextcloud client, qtkeychain and the “The name org.freedesktop.secrets was not provided by any .service files” error](https://rtfm.co.ua/en/linux-the-nextcloud-client-qtkeychain-and-the-the-name-org-freedesktop-secrets-was-not-provided-by-any-service-files-error/)