# Unraid OS and how Kopia stores password **URL:** \ **Category:** Support\ **Created:** [May 3, 2021, 4:59pm UTC](https://kopia.discourse.group/t/unraid-os-and-how-kopia-stores-password/441 "2021-05-03T16:59:16Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![xxxliqu1dxxx](https://avatars.discourse-cdn.com/v4/letter/x/f08c70/32.png) [@xxxliqu1dxxx](https://kopia.discourse.group/u/xxxliqu1dxxx)\ **Post date:** [May 3, 2021, 4:59pm UTC](https://kopia.discourse.group/t/unraid-os-and-how-kopia-stores-password/441/1 "2021-05-03T16:59:16Z")
Hi all, new to Kopia, I like what I read so far and been trying it out on several clients. However, I ran into what I think is an issue and unsure on how to resolve. On my Unraid box, after I created the repo, I noticed it stored the password in base64, under /root/.config/kopia/repository.config.kopia-password. That was without the --use-keyring option (shouldn’t it using keyring by default?). When I tried with Keyring, it gave me: kopia: error: unable to connect to repository: error connecting to repository: unable to persist password: error saving password in key ring: exec: “dbus-launch”: executable file not found in $PATH, try --help On one hand, I am not sure how to validate if Unraid can use dbus-launch and would love to have credentials stored securely, but I am also concerned to see credentials stored in what is effectively plain text, i.e. base64. Would someone have an insight into that? Thank you in advance! ---
**Author:** ![jkowalski](https://yyz2.discourse-cdn.com/free1/user_avatar/kopia.discourse.group/jkowalski/32/3_2.png) [@jkowalski](https://kopia.discourse.group/u/jkowalski)\ **Post date:** [May 4, 2021, 4:48am UTC](https://kopia.discourse.group/t/unraid-os-and-how-kopia-stores-password/441/2 "2021-05-04T04:48:49Z")
Keyring is unfortunately unreliable on Linux (as you discovered) so it’s disabled by default. I’d recommend the following options: 1. Get `dbus-launch` installed on your machine, but configuration of that may be non-trivial without full desktop environment. 2. (Do nothing) and have kopia persist base64-encoded password in local file. The file is only readable by the user that started Kopia and `root` which is generally assumed to be trusted. Storing plaintext credentials in files under user directory is not great, but quite common on Linux so this would be no exception and depending on your security needs may be appropriate (typically encrypted disk + strong local password + locked down remote access provide reasonable security even when attacker gets physical access to the machine, but there’s really not much that can be done against really sophisticated local side-channel attacks). 3. Do not persist passwords at all on connection (`--no-persist-connection`) and instead always pass password manually using `KOPIA_PASSWORD` environment variable or via `--password` flag. You can retrieve the password using some external command like so: ```auto KOPIA_PASSWORD=$(my-password-command) kopia snapshot create ... ``` > **NOTE** that `~/.config/kopia/repository.config` may still have some credentials (e.g. S3 access keys) and is currently not locally encrypted. Same argument can be made as for #1, but will try to fix that in future versions by encrypting this file with the `KOPIA_PASSWORD`-derived key. 1. Help improve Kopia by submitting PRs that will integrate with other key stores (such as [https://www.vaultproject.io](https://www.vaultproject.io) and others) ---
**Author:** ![xxxliqu1dxxx](https://avatars.discourse-cdn.com/v4/letter/x/f08c70/32.png) [@xxxliqu1dxxx](https://kopia.discourse.group/u/xxxliqu1dxxx)\ **Post date:** [May 4, 2021, 12:01pm UTC](https://kopia.discourse.group/t/unraid-os-and-how-kopia-stores-password/441/3 "2021-05-04T12:01:59Z")
Thank you for the detailed explanations and offering several choices! Really appreciated! ---
**Author:** ![jrdemasi](https://yyz2.discourse-cdn.com/free1/user_avatar/kopia.discourse.group/jrdemasi/32/149_2.png) [@jrdemasi](https://kopia.discourse.group/u/jrdemasi)\ **Post date:** [May 4, 2021, 9:34pm UTC](https://kopia.discourse.group/t/unraid-os-and-how-kopia-stores-password/441/4 "2021-05-04T21:34:47Z")
I’d +1 not storing creds in the file and just having an option to ONLY pull them from an env var or something at runtime. In particular, I don’t even really want to password protect the files, I just don’t want my aws credentials in it if at all possible.