starting gpg-agent using some method which works

cfr · 2015-02-08 23:06:07

EDIT: As I explain in the next post, I think it might make more sense to start gpg-agent with systemd. But I can't figure out how to get the environment configured correctly.

I am trying to switch from KDE 4 to Plasma 5 but I'm having a few teething troubles.

In KDE 4, I used a slightly customised startup and shutdown script to start gpg-agent and set the pinentry program:

/etc/kde/env/gpg-agent-startup.sh:

#!/bin/sh
# see https://wiki.archlinux.org/index.php/SSH_Keys

GPG_AGENT=/usr/bin/gpg-agent
## Run gpg-agent only if not already running, and available
if [ -x "${GPG_AGENT}" ] ; then

  # check validity of GPG_SOCKET (in case of session crash)
  GPG_AGENT_INFO_FILE=${HOME}/.gpg-agent-info
  if [ -f "${GPG_AGENT_INFO_FILE}" ]; then
    GPG_AGENT_PID=`cat ${GPG_AGENT_INFO_FILE} | grep GPG_AGENT_INFO | cut -f2 -d:`
    GPG_PID_NAME=`cat /proc/${GPG_AGENT_PID}/comm`
    if [ ! "x${GPG_PID_NAME}" = "xgpg-agent" ]; then
      rm -f "${GPG_AGENT_INFO_FILE}" 2>&1 >/dev/null
    else
       GPG_SOCKET=`cat "${GPG_AGENT_INFO_FILE}" | grep GPG_AGENT_INFO | cut -f1 -d: | cut -f2 -d=`
       if ! test -S "${GPG_SOCKET}" -a -O "${GPG_SOCKET}" ; then
         rm -f "${GPG_AGENT_INFO_FILE}" 2>&1 >/dev/null
       fi
    fi
    unset GPG_AGENT_PID GPG_SOCKET GPG_PID_NAME SSH_AUTH_SOCK
  fi

  if [ -f "${GPG_AGENT_INFO_FILE}" ]; then
    eval "$(cat "${GPG_AGENT_INFO_FILE}")"
    eval "$(cut -d= -f 1 "${GPG_AGENT_INFO_FILE}" | xargs echo export)"
    export GPG_TTY=$(tty)
  else
    eval "$(${GPG_AGENT} -s --enable-ssh-support --daemon --pinentry-program /usr/bin/pinentry-qt4 --write-env-file)"
  fi

fi

/etc/kde/shutdown/gpg-agent-shutdown.sh:

#!/bin/sh

## The nice way
if test -n "${GPG_AGENT_INFO}"; then
  GPG_AGENT_PID=`echo ${GPG_AGENT_INFO} | cut -d: -f2` && kill ${GPG_AGENT_PID} ||:
  unset GPG_AGENT_INFO
  unset SSH_AUTH_SOCK
fi

## The not so nice way
## NOTE: a root login will kill *all* users' gpg-agents
#killall gpg-agent

## clean/remove .gpg-agent-info
rm -f $HOME/.gpg-agent-info

/etc/kde/shutdown/ssh-agent-shutdown.sh:

#!/bin/sh

if [ -n "${SSH_AGENT_PID}" ]; then
  kill ${SSH_AGENT_PID}
  unset SSH_AGENT_PID SSH_AUTH_SOCK
fi

I don't think the second one was probably necessary.

I know that startup scripts should now be in /etc/plasma-workspace/env. I'm guessing the others should be in /etc/plasma-workspace/shutdown.

However, I'm not at all sure that the contents of these scripts is correct. In particular, I think that GPG_AGENT_INFO is obsolete? [But this was working fine with KDE 4 for whatever reason.]

The wiki page at https://wiki.archlinux.org/index.php/Gn … passphrase is confusing me because I am not sure how it relates to my previous, working configuration. And I'm not sure exactly which bits are out of date. https://wiki.archlinux.org/index.php/GnuPG#gpg-agent suggests that the above script is probably out of date. It redirects me to https://wiki.archlinux.org/index.php/Gn … passphrase, but I don't think that I was piping a password in and I did not need to configure this before switching to Plasma 5. So how do I configure gpg-agent if I do NOT want to use the --passphrase -fd 0 option? Or have I just misunderstood the wiki completely?

[This wouldn't be so bad if I could remember the password for my SSH key but I can't. I can only remember my password for the pinentry programme.]

Last edited by cfr (2015-02-15 20:58:48)

cfr · 2015-02-09 01:18:58

It would be nice, actually, if the gpg-agent support for SSH did not depend on KDE, so that it would still work in other contexts. (At least other desktop environments, even if not in a tty.)

Adapting the example from the wiki, I wonder if I could install this as /etc/systemd/user/gpg-agent.service:

[Unit]
Description=GnuPG private key agent
IgnoreOnIsolate=true

[Service]
Type=forking
ExecStart=/usr/bin/gpg-agent --daemon --homedir=%h/.config/gnupg -s --enable-ssh-support --pinentry-program /usr/bin/pinentry-qt4 
ExecStop=/usr/bin/pkill gpg-agent
Restart=on-abort

[Install]
WantedBy=multi-user.target

But I cannot figure out how to set GPG_TTY because this requires evaluating a command. I know that I can set an environment variable using DefaultEnvironment in /etc/systemd/user.conf or /etc/systemd/user.conf.d. But all of the examples I've seen just specify the value - they don't require running a command to get the value.

So should I just put

export GPG_TTY=$(tty)

in /etc/profile/gpg-agent.sh? I'm not sure if it is 'safe' to set the variable independently from starting the service or if these should really be done all at once the way they were with the KDE 4 script I was using.

I see that there is an option to install gpg startup scripts for KDE through pacman, and I could presumably install that to figure out what it does. However, the systemd method is quite attractive if (1) I can get it to work and (2) I can be sure it is secure.

cfr · 2015-02-11 23:24:31

I figured out that I can start gpg-connect-agent and it seems to take care of things like avoiding multiple instances, exporting the tty etc. However, it appears to take no notice of settings I put in configuration files in ~/.gnupg. If I start gpg-agent directly, my configuration files are used, but if I start it via gpg-connect-agent, they are ignored.

I can't entirely tell from the man page whether this is by design or if I am doing something wrong.

$ cat gpg-agent.conf

# GPGConf disabled this option here at Dydd Llun 08 mis Medi 2014 21:43:30 BST
# default-cache-ttl 300
# GPGConf disabled this option here at Dydd Llun 08 mis Medi 2014 21:43:30 BST
# max-cache-ttl 999999
###+++--- GPGConf ---+++###
default-cache-ttl 300
max-cache-ttl 3000
###+++--- GPGConf ---+++### Dydd Llun 08 mis Medi 2014 21:43:30 BST
# GPGConf edited this configuration file.
# It will disable options before this marked block, but it will
# never change anything below these lines.
pinentry-program /usr/bin/pinentry-qt4
enable-ssh-support

If I then start gpg-agent by hand e.g. gpg-agent --daemon, and export the line it feeds me back, everything is fine. If, however, I use gpg-connect-agent /bye, then it works only if the environmental variables have already been set.

cfr · 2015-02-15 20:54:37

Giving up on systemd, I decided to ignore Arch's wiki and did the following:

Following the gpg-agent man page, I added the following to /etc/bash.bashrc. [The man page says to add it to ~/.bashrc, but /etc/bash.bashrc is sourced by ~/.bashrc.]

# from man 1 gpg-agent (but it doesn't say why and I'm not sure if it should really be here or only in regular users home .bashrc files or if it should be for non-interactive shells, too, or only for interactive ones or...)
export GPG_TTY=$(tty)

# also from man gpg-agent (gpg-agent info is no longer used, I think)
unset SSH_AGENT_PID
# I don't really understand what this does - what is the purpose of the check exactly?
if [ "${gnupg_SSH_AUTH_SOCK_by:-0}" -ne $$ ]; then
        export SSH_AUTH_SOCK="${HOME}/.gnupg/S.gpg-agent.ssh"
fi

I don't understand the purpose of the check before setting SSH_AUTH_SOCK. What is the point of the comparison with the PID of the current process exactly? And what is gnupg_SSH_AUTH_SOCK exactly?

Also, the way this is set up, it will only run for interactive shells. I have no idea whether this is right or not.

I then created a file in /etc/profile.d with the following content:

/usr/bin/gpg-connect-agent /bye

It seems that although running this manually does not pick up settings in ~/.gnupg/gpg-agent.conf, those settings are picked up when this is executed as part of the shell initialisation. That is, this method seems to work.

However, I would feel more comfortable if I understood what I've done well enough to determine whether this is a reasonable approach or not, and why the advice in the wiki seems to differ markedly from the advice in gpg-agent's man page.

anatolik · 2015-02-15 21:29:04

cfr wrote:

# from man 1 gpg-agent (but it doesn't say why and I'm not sure if it should really be here or only in regular users home .bashrc files or if it should be for non-interactive shells, too, or only for interactive ones or...)
export GPG_TTY=$(tty)

# also from man gpg-agent (gpg-agent info is no longer used, I think)
unset SSH_AGENT_PID
# I don't really understand what this does - what is the purpose of the check exactly?
if [ "${gnupg_SSH_AUTH_SOCK_by:-0}" -ne $$ ]; then
        export SSH_AUTH_SOCK="${HOME}/.gnupg/S.gpg-agent.ssh"
fi

I don't understand the purpose of the check before setting SSH_AUTH_SOCK. What is the point of the comparison with the PID of the current process exactly? And what is gnupg_SSH_AUTH_SOCK exactly?

2 minutes googling pointed me to this page https://gitorious.org/gnupg-org/gnupg/c … fb879fc29b

cfr · 2015-02-15 22:32:59

anatolik wrote:

2 minutes googling pointed me to this page https://gitorious.org/gnupg-org/gnupg/c … fb879fc29b

Thanks. For some reason, I didn't think of ixqing the environmental variable itself.

However, it does not actually seem to be set when gpg-agent is already running. That is, I would expect a check to see if the SSH socket had already been set, say, but I don't see how this can work because gnupg_SSH_AUTH_SOCK_by (unlike _SSH_AUTH_SOCK) does not actually seem to get set in the environment. So the test looks as if it will always pass.

$ printenv | grep -i gnu | sed "s/${USER}/username/"
SSH_AUTH_SOCK=/home/username/.gnupg/S.gpg-agent.ssh

Also, that link suggests unsetting GPG_AGENT_INFO which I had understood was now deprecated and would have no effect. One reason I'm confused is because the wiki seems to still be half written for the old method and half for the new. For example, https://wiki.archlinux.org/index.php/SS … nuPG_Agent uses the --write-envfile option for gpg-agent, but gpg-agent no longer supports that option so far as I can tell. And that is tied in with the use of GPG_AGENT_INFO invoked at that link, isn't it?

Last edited by cfr (2015-02-15 22:34:01)

2bluesc · 2015-02-22 20:37:34

Not sure if you figured this out, but I have a systemd user unit file @ https://github.com/kylemanna/systemd-ut … nt.service if you're interested. Works just fine with mutt from the command line. GPG 2.1 changed things a bit, so be careful what you read today, but it seems that you already know that.

The goal of my systemd unit file was to pass special arguments to systemd so that a special gpg private key could be used for backups unattended. If only the back-up tool (obnam) didn't need to decrypt some de-dup tables it wouldn't need the passphrase.... that's a problem for another time thought I think.

Arch Linux

#1 2015-02-08 23:06:07

starting gpg-agent using some method which works

#2 2015-02-09 01:18:58

Re: starting gpg-agent using some method which works

#3 2015-02-11 23:24:31

Re: starting gpg-agent using some method which works

#4 2015-02-15 20:54:37

Re: starting gpg-agent using some method which works

#5 2015-02-15 21:29:04

Re: starting gpg-agent using some method which works

#6 2015-02-15 22:32:59

Re: starting gpg-agent using some method which works

#7 2015-02-22 20:37:34

Re: starting gpg-agent using some method which works

Board footer