Arch Linux

lesh

Member

Registered: 2009-01-29

Posts: 5

Screen locker that's also pinentry for gpg-agent?

Hi, after my screen locks, my gpg-agent gets restarted in order to forget decrypted secret keys. (actually, re-lock a gpg-card, but nvm)

so, after unlocking the screen, most of the time I'll have to unlock my gpg keys soon after too. I'm thinking how I'd like to use the same key for my screen locker and my gpg pin and I'd like to be asked about it only once.

I'm thinking that I could modify an existing screen locker to act as a pinentry program too, in this case, screen locker would actually be run by a gpg-agent.

I'd lock the screen by doing "systemctl --user restart gpg-agent.service" (this service would be modified so that it tries to decrypt something as soon as its up.)

this feels a bit ugly but its the only reasonable way to implement this that comes to mind (without storing the pin on a drive as a hash and in the memory to be asked for it later by a gpg-agent)

what do you ppl think? is this a good idea? did anyone do anything similar?

progandy

Member

Registered: 2012-05-17

Posts: 5,322

Re: Screen locker that's also pinentry for gpg-agent?

I don't know of a PAM module for a pure gpg-agent setup, but you might try envoy from the community repository.
https://github.com/vodik/envoy
You would set the same password for your user and the keyring and then when your username is unlocked, the pam module uses the password to unlock the keyring as well.

Edit: Sorry, that will set a passphrase token in a cache using "gpg-preset-passphrase" You might be able to do something similar with pam_exec as well.

Last edited by progandy (2015-10-01 21:58:26)

---

| alias CUTF='LANG=en_XX.UTF-8@POSIX ' | alias ENGLISH='LANG=C.UTF-8 ' |

lesh

Member

Registered: 2009-01-29

Posts: 5

Re: Screen locker that's also pinentry for gpg-agent?

PAM, right! thanks, I'll look into it.

I'm using a smartcard and now this gets relevant but a quick google is revealing that I can use Libpam-poldi to login via gpg smartcard. thanks for good feedback, I have some stuff figure out now.