2

On MacOS High Sierra (10.13.3), how do I lock my screen without locking my keychain?

I run some long-running terminal scripts that make periodic use of the keychain, and would like the ability to lock my screen and walk away for lunch, without causing the terminal scripts to block for a password prompt.

  • Keychain has a timeout of 300 seconds (if I remember correctly). It's highly unlikely that it stops because your display sleeps/locks but rather it exceeds that time limit. Are you using sudo to execute these commands in the script? – Allan May 7 '18 at 16:39
  • 1
    security set-keychain-settings -h ;-) – klanomath May 7 '18 at 16:43
  • I am not using sudo. The script invokes some ssh utilities that know how to leverage the keychain. – Chris Betti May 7 '18 at 18:13
  • I tested the timeout theory using various values for the timeout, and triggering a keychain use via ssh every 5 seconds in a loop in the terminal. When I lock my screen via the Lock Screen option in the apple menu, the loop is interrupted within 5 to 10 seconds regardless of the keychain timeout value. This is with a security set-keychain-settings -u -t 7200 keychain configuration. – Chris Betti May 8 '18 at 15:12
  • I also tested that this is unrelated to sleep by keeping the locked display awake (mouse movement) for a minute, and then unlocking again via password. Once I login, I see that my script has paused shortly after the lock screen is displayed, prompting for keychain password. Loss of keychain access seems highly related to a transition to the lock screen. – Chris Betti May 8 '18 at 15:16
2

If you have a screensaver you can lock that with your password so whenever screensaver tries to quit it needs a password. To set this up, first set up your screensaver if you don't have one. Then open System Preferences/Security and Privacy. Click the first tab in that window named General. The 2nd line on this box allows you to set a password associated with the screensaver.

1

This is not possible since interactive keychain usage is limited to console authorization. When the screen is locked, all of that is revoked. On top of that, it’s not that you are locking the screen, but you are locking your session which includes not only the screen, but keychains, DMA, smartcards and some networking capabilities as well.

  • I see, helpful. I guess a workaround would involve starting a separate session for these long lived scripts. First thing that comes to mind is sshing back into my machine and using a no hang-up wrapper around my terminal session. – Chris Betti May 14 '18 at 1:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .