Using gpg-agent - Revision history

David: added gnuk

2017-06-14T22:32:18Z

added gnuk

← Older revision		Revision as of 22:32, 14 June 2017
Line 1:		Line 1:
			Why do this? First, it limits the number of projects responsible for your keys; and second. it works well with smartcards / things like Gnuk!

	There are several key things missing from all extant guides for using gpg-agent rather than ssh-agent. The main ones are: double check permissions, specification of the pinentry program, and setting SSH_AUTH_SOCK. You'll also need to add your key using ssh-add, and set nice timeouts.		There are several key things missing from all extant guides for using gpg-agent rather than ssh-agent. The main ones are: double check permissions, specification of the pinentry program, and setting SSH_AUTH_SOCK. You'll also need to add your key using ssh-add, and set nice timeouts.

David: /* modifying .xsessionrc */ Fixed mistaken wiki interpretation of symbols in code block

2016-04-11T16:39:00Z

modifying .xsessionrc: Fixed mistaken wiki interpretation of symbols in code block

← Older revision		Revision as of 16:39, 11 April 2016
Line 22:		Line 22:
	Add this to $HOME/.xsessionrc (some may not be necessary; I will update this):		Add this to $HOME/.xsessionrc (some may not be necessary; I will update this):

			<nowiki>
	GPGAGENT=/usr/local/bin/gpg\-agent		GPGAGENT=/usr/local/bin/gpg\-agent
	envfile="$HOME/.gnupg/gpg-agent.env"		envfile="$HOME/.gnupg/gpg-agent.env"
Line 37:		Line 38:
	#echo did export SSH_AUTH_SOCK=$SSH_AUTH_SOCK >> $HOME/gpgagent_debug		#echo did export SSH_AUTH_SOCK=$SSH_AUTH_SOCK >> $HOME/gpgagent_debug
	fi		fi
			</nowiki>

	==stop gnome-keyring and ssh-agent from running==		==stop gnome-keyring and ssh-agent from running==

David at 16:35, 11 April 2016

2016-04-11T16:35:53Z

← Older revision		Revision as of 16:35, 11 April 2016
Line 1:		Line 1:
	~~Unfinished~~		There are several key things missing from all extant guides for using gpg-agent rather than ssh-agent. The main ones are: double check permissions, specification of the pinentry program, and setting SSH_AUTH_SOCK. You'll also need to add your key using ssh-add, and set nice timeouts.

	~~The two~~ key things missing from all extant guides for using gpg-agent rather than ssh-agent are: specification of the pinentry program, and setting SSH_AUTH_SOCK. You'll also need to add your key using ssh-add, and set nice timeouts.

	==generate your keys==		==generate your keys==
	Use the guide on secure secure shell in [[PrivacyGroup#other tools]] to generate strong keys.		Use the guide on secure secure shell in [[PrivacyGroup#other tools]] to install GPG from signed source with a verified hash, and to generate strong keys. I installed the latest stable version.

	==getting gpg-agent to run on startup with ssh support==		==getting gpg-agent to run on startup with ssh support==
Line 20:		Line 18:

	==modifying .xsessionrc==		==modifying .xsessionrc==
			There's an environment file (which I've called gpg-agent.env) which holds some environment variables that need to be set. If it doesn't exist, it is generated and subsequently reused. There's also some logging done for debugging which parts of the script ran, which you can disable once things work by commenting out.

	Add this to $HOME/.xsessionrc (some may not be necessary; I will update this):		Add this to $HOME/.xsessionrc (some may not be necessary; I will update this):

Line 38:		Line 38:
	fi		fi

	After restarting (or just restarting X, ~~if you know how.~~..), do		==stop gnome-keyring and ssh-agent from running==
			In Ubuntu you'll need to move to a temporary location the files gnome-keyring-* from /usr/share/upstart/sessions (these can be removed once everything works, if desired).

			==check the permissions on your .gnupg and .ssh directories==
			gpg-agent will silently fail with SSH_AGENT_FAILED (if I remember right) if the permissions for your directories are not correct. Ensure for .gnupg and .ssh, you do chmod 700 ~/.{.gnupg,.ssh},
			and also chmod 600 ./* ~/.gnupg && chmod 600 ~/.ssh. Then do chmod 700 ~/.gnupg/{private-keys-v1.d,crls.d}, and chmod 644 ~/.ssh/*.pub && chmod 600 $(ls ~/.ssh \| grep -v pub).

			==restart and check that things worked==
			After restarting (or just restarting X, e.g. on Ubuntu, switching to another terminal with ctl-alt-F1, logging in and doing 'sudo service lightdm restart'), do

	gpg-agent		gpg-agent

	on its own to tell if the agent is running.		on its own to tell if the agent is running, then

			env \| grep -Ei "(ssh)\|(gpg)"

			to check the environment variables that have been set. You should see GPG_AGENT_INFO with a string like /tmp/gpg-p5FAuH/S.gpg-agent:1611:1 . If the path in the first field isn't in tmp like that, you may have ssh-agent or gnome-keyring running, which you'll need to stop. You should also see GPG_TTY=/dev/pts/19 . This should be your tty (check by doing 'tty'). Finally, you should see the socket location, which should look like SSH_AUTH_SOCK=/tmp/gpg-Ry2jg5/S.gpg-agent.ssh.

David at 23:33, 12 November 2015

2015-11-12T23:33:29Z

← Older revision		Revision as of 23:33, 12 November 2015
Line 3:		Line 3:
	The two key things missing from all extant guides for using gpg-agent rather than ssh-agent are: specification of the pinentry program, and setting SSH_AUTH_SOCK. You'll also need to add your key using ssh-add, and set nice timeouts.		The two key things missing from all extant guides for using gpg-agent rather than ssh-agent are: specification of the pinentry program, and setting SSH_AUTH_SOCK. You'll also need to add your key using ssh-add, and set nice timeouts.

	==~~setting pinentry and~~ other ~~options for~~ gpg-agent==		==generate your keys==
			Use the guide on secure secure shell in [[PrivacyGroup#other tools]] to generate strong keys.

			==getting gpg-agent to run on startup with ssh support==
	Copy this to .gnupg/gpg-agent.conf:		Copy this to .gnupg/gpg-agent.conf:
	enable-ssh-support		enable-ssh-support

			==setting good timeouts==
			Copy this to .gnupg/gpg-agent.conf:
	default-cache-ttl-ssh 28800		default-cache-ttl-ssh 28800
	max-cache-ttl-ssh 43200		max-cache-ttl-ssh 43200

			==setting pinentry and other options for gpg-agent==
			Copy this to .gnupg/gpg-agent.conf:
	pinentry-program /usr/bin/pinentry-gtk-2		pinentry-program /usr/bin/pinentry-gtk-2

Line 20:		Line 29:
	else		else
	eval "$($GPGAGENT --daemon --enable-ssh-support --write-env-file "$envfile")"		eval "$($GPGAGENT --daemon --enable-ssh-support --write-env-file "$envfile")"
	echo did $GPGAGENT --daemon --enable-ssh-support --write-env-file "$envfile" >> $HOME/gpgagent_debug		#echo did $GPGAGENT --daemon --enable-ssh-support --write-env-file "$envfile" >> $HOME/gpgagent_debug
	fi		fi
	export GPG_AGENT_INFO # the env file does not contain the export statement		export GPG_AGENT_INFO # the env file does not contain the export statement
Line 26:		Line 35:
	if [ "${gnupg_SSH_AUTH_SOCK_by:-0}" -ne $$ ]; then		if [ "${gnupg_SSH_AUTH_SOCK_by:-0}" -ne $$ ]; then
	export SSH_AUTH_SOCK="${HOME}/.gnupg/S.gpg-agent.ssh"		export SSH_AUTH_SOCK="${HOME}/.gnupg/S.gpg-agent.ssh"
	echo did export SSH_AUTH_SOCK=$SSH_AUTH_SOCK >> $HOME/gpgagent_debug		#echo did export SSH_AUTH_SOCK=$SSH_AUTH_SOCK >> $HOME/gpgagent_debug
	fi		fi

			After restarting (or just restarting X, if you know how...), do

			gpg-agent

			on its own to tell if the agent is running.

David: Created page with "Unfinished The two key things missing from all extant guides for using gpg-agent rather than ssh-agent are: specification of the pinentry program, and setting SSH_AUTH_SOCK...."

2015-11-12T23:24:04Z

Created page with "Unfinished The two key things missing from all extant guides for using gpg-agent rather than ssh-agent are: specification of the pinentry program, and setting SSH_AUTH_SOCK...."

New page

Unfinished

The two key things missing from all extant guides for using gpg-agent rather than ssh-agent are: specification of the pinentry program, and setting SSH_AUTH_SOCK. You'll also need to add your key using ssh-add, and set nice timeouts.

==setting pinentry and other options for gpg-agent==
Copy this to .gnupg/gpg-agent.conf:
enable-ssh-support
default-cache-ttl-ssh 28800
max-cache-ttl-ssh 43200
pinentry-program /usr/bin/pinentry-gtk-2

==modifying .xsessionrc==
Add this to $HOME/.xsessionrc (some may not be necessary; I will update this):

GPGAGENT=/usr/local/bin/gpg\-agent
envfile="$HOME/.gnupg/gpg-agent.env"
if [[ -e "$envfile" ]] && kill -0 $(grep GPG_AGENT_INFO "$envfile" | cut -d: -f 2) 2>/dev/null; then
eval "$(cat "$envfile")"
echo ran $(cat "$envfile") >> $HOME/gpgagent_debug
else
eval "$($GPGAGENT --daemon --enable-ssh-support --write-env-file "$envfile")"
echo did $GPGAGENT --daemon --enable-ssh-support --write-env-file "$envfile" >> $HOME/gpgagent_debug
fi
export GPG_AGENT_INFO # the env file does not contain the export statement
unset SSH_AGENT_PID
if [ "${gnupg_SSH_AUTH_SOCK_by:-0}" -ne $$ ]; then
export SSH_AUTH_SOCK="${HOME}/.gnupg/S.gpg-agent.ssh"
echo did export SSH_AUTH_SOCK=$SSH_AUTH_SOCK >> $HOME/gpgagent_debug
fi