mjhjmtu

I was thinking of the good way to secure my KeePass database on my personal PC.

I use Windows as my host, so my idea is to install some secure Linux distro and run KeePass from there. In addition to password, I would also use a key file, to which only root would have access. My reasoning is that if someone got access to my Linux VM, it's less likely they would compromise KeePass because key is only accessible by root.

Now that means I would have to run KeePass with root privileges, in order to use the key file (not sure if that is the good idea).

Does my setup makes sense? I feel like if I don't assign different access rights to key file, then it's completely loses it's purpose (as in, anyone who can access KeePass DB file, can access key file as well).

Your solution seems overly complicated. Just use LUKS with a strong passphrase to do a whole disk encryption of your Linux VM, and you'll be fine.

You don't even need to run Linux for it -- make an encrypted volume (e.g. via Veracrypt) on your PC and store the KeePass database file in it.

To be honest, I'm not sure if it will provide You with any additional layer of security.

If You would like to do so, You would need to encrypt the Linux partition and I would recommend to use KP with regular user privileges. As You seem to be very concerned about security, I would recommend also to totally abandon Windows and, maybe, use only Linux installed on LiveCD (pen-drive).

One of the Linux distribution designed with security in mind is Qubes OS (https://www.qubes-os.org/), where every application is sandboxed in a separate virtual machine. So You can separate one program (eq. Internet browser with bank application) from other (Your password store). As far as I know, you can also totally block access to the Internet for some applications.

And, If You need it really badly, You can also virtualize Windows, in order to use some proprietary software.

Last but not least, It is recommended by Snowden himself ;)

KeePass documentation says the database file is encrypted. Ideally, the attacker can not find the contents of the encrypted database without the encryption key (derived from master password).

A strong master password will be more useful as security measure than adding additional layers of access control.

No, your setup doesn't make any sense at all. Keepass doesn't become more secure by putting it into a VM, no matter the OS it is running. Even on Linux, root or "normal" user also doesn't make any difference at all.

The one thing you got right is that there isn't too much added value by storing the keyfile next to (i.e. with the same permissions) the database.

I keep my kdbx file in the cloud, b/c I am accessing it from many different devices. However, I keep the keyfile out of the Internet AND change it regularly. On my devices I keep the keyfile in an encrypted volume/file and the database itself is password protected.
To open the file I need username/password for my cloud account, a password to uncrypt the FS holding the keyfile and another password for the DB. However, while working with the database, Keepass keeps a local copy of the database, which means database and keyfile are accessible using the same credentials on the same machine. I never checked how that local copy is stored, I only know it exists.

IMO it doesn't get a lot more secure than that. I suppose if one uses the kdbx locally only, then you could put the kdbx in another encrypted volume/file. However, the kdbx is already encrypted and its a long shot assumiung another wrapper of encryption adds more security. There have been algorithms known to become less secure when applying more often ...

Do not use the root account for this.

If you're concerned of malware catching your keyfile, you can create a keepass user.

# as root

# add user and enter credentials
adduser keepass

# move the files to keepass' home
mv database.kdbx keyfile /home/keepass/

# make keepass the owner and change permissions
chown keepass: /home/keepass/database.kdbx,keyfile
chmod 600 /home/keepass/database.kdbx
chmod 400 /home/keepass/keyfile

Then you can run keepass with the keepass user, e.g.:

ssh -X keepass@localhost keepassx

Read the answers to this question for more (and maybe better) methods running a GUI application as another user.

Note that this will not protect you from someone with physical access to your computer or hard drive stealing your keyfile.

Some additional hints

They keyfile is a good option when you share the database via insecure channels (e.g. the internet) and store it on insecure devices (e.g. USB Sticks).

You can also separate the database from the keyfile to make it more difficult for malware to grab both files. See this answer to a similar question which indicates to store the keyfile on USB. I doubt that an unencrypted device is secure, but when you store the keyfile in an encrypted container on an USB device (or on your computer), you should be fine.