3

I stumbled upon this using Tunnelblick and Viscosity. Adding a configuration to those VPN tools it is possible in the GUI during the first connect to specify user&pass and save them in the keychain. The next connections will then use the saved credentials from keychain.

However if I change the password in the keychain using the security terminal command (add-generic-password -U-s-a-w) or via keychain access application, afterwards both Tunnelblick and Viscosity will show the "Permission to access keychain: [Allow, Allow always, cancel]"-dialog if I try connecting the next time.

Is there any way to prevent this dialog?

  • I looked a bit in the Tunnelblick source code, but couldn't find a check for "keychain tampering" or anything that could force this dialog from Tunnelblick's side.
  • If it is an configurable OS level protection?
Improve this question
3
  • If you edit a Keychain entry outside of the application, it makes sense to me that OS X would prompt you to confirm you want the app to be able to access it. When you click Allow Always, does it not remember that setting?
    – tubedogg
    Sep 23, 2016 at 18:45
  • With "Allow Always" it remembers until the password is changed (again). However I doubt that it makes sense, that this is not configurable. You need elevated user privileges (twice) in order to change the entry, why should you be informed again upon first access. I understand that some "integrity check" might be useful, but it is not a catchable warning, it is a GUI popup as soon as you try to access the keychain (if I understand the Tunnelblick source code correctly).
    – NextThursday
    Sep 26, 2016 at 14:13
  • Multiple applications can access a single keychain item. In your case you happen to be modifying the item and trying to use it again in the same application, but again you're modifying it outside the purview of the application you previously authorized to use it. Therefore it makes perfect sense that OS X wants to confirm you are intending to allow access to the updated credentials that are stored, just as it would if an application tried to access a keychain item that it hadn't created.
    – tubedogg
    Sep 26, 2016 at 17:08

1 Answer 1

Reset to default
1

For macOS Sierra:

To add an object and allow access (with user prompt), use the "-T Application" option. (Several applications can be used)

security add-generic-password -a "account" -s "name" -w 'password' -c aapl -T /Applications/Utilities/Keychain\ Access.app/Contents/MacOS/Keychain\ Access

Then to allow access without user prompt you need to modify the ACL for the object:

security -v set-generic-password-partition-list -s "name" -S "apple:"

The partition-list syntax is not very well documented. You might be able to see how Tunnelblick uses the ACL from the output of "security dump-keychain".

Source: man security

Improve this answer
1
  • I think this is the correct answer, however you and the documentation both suggest using security dump-keychain to look for example options for -S, but I can't see anything in there to use as an example :(
    – SillyWilly
    Mar 10, 2017 at 14:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .