Arch Linux

physfizz

Member

Registered: 2014-01-07

Posts: 9

help with gpg-agent, ssh, and pinentry-curses

I use gpg-agent to manage my ssh keys, and for a system that I regularly ssh into, I would like to use pinentry-curses instead of the default pinentry-gtk-2. However, this doesn't work.

Specifically, I start gpg-agent using script from the arch wiki, /etc/profile.d/gpg-agent.sh:

if [ $EUID -ne 0 ] ; then
    envfile="$HOME/.gnupg/gpg-agent.env"
    if [[ -e "$envfile" ]] && kill -0 $(grep GPG_AGENT_INFO "$envfile" | cut -d: -f 2) 2>/dev/null; then
        eval "$(cat "$envfile")"
    else
        eval "$(gpg-agent --daemon --enable-ssh-support --write-env-file "$envfile")"
    fi
    export GPG_AGENT_INFO  # the env file does not contain the export statement
    export SSH_AUTH_SOCK   # enable gpg-agent for ssh
fi

and have the following config files

~/.gnupg/gpg-agent.conf:

# Keyboard control
no-grab
  
# PIN entry program
pinentry-program /usr/bin/pinentry-curses
#pinentry-program /usr/bin/pinentry-qt4
#pinentry-program /usr/bin/pinentry-kwallet
#pinentry-program /usr/bin/pinentry-gtk-2

~/.gnupg/gpg.conf:

use-agent

~/.bashrc:

GPG_TTY=$(tty)
export GPG_TTY

Whenever I attempt to ssh using the key that's already been added to gpg-agent, I get the following message:

Agent admitted failure to sign using the key.
Permission denied (public key).

If I change my ~/.gnupg/gpg-agent.conf file to the following:

# Keyboard control
#no-grab
  
# PIN entry program
#pinentry-program /usr/bin/pinentry-curses
#pinentry-program /usr/bin/pinentry-qt4
#pinentry-program /usr/bin/pinentry-kwallet
pinentry-program /usr/bin/pinentry-gtk-2

then everything works fine, and I'm prompted for my passphrase when using ssh.

I've read posts having to do with a similar issue:
https://bbs.archlinux.org/viewtopic.php?id=138546
https://bugs.archlinux.org/task/29156

It looks like the difference between those and my issue is that I'm using ssh, not just gpg, and I'm not using su. In fact, if I have pinentry-curses set in gpg-agent.conf, and I try to use gpg to encrypt and decrypt a file, everything works fine. The file encrypts, and when decrypting, I am prompted by pinentry-curses for my passphrase. It's just ssh combined with pinentry-curses that gives me troubles.

firecat53

Member

From: Lake Stevens, WA, USA

Registered: 2007-05-14

Posts: 1,542

Website

Re: help with gpg-agent, ssh, and pinentry-curses

I think it actually is the tty capability bug that's biting you...try adding '--without-libcap' to the pinentry-curses PKGBUILD from ABS (/var/abs/core/pinentry/) and rebuilding the package.

Scott

---

Github