Arch Linux

p90

Member

Registered: 2013-06-07

Posts: 21

Unlock gpg-agent with pam?

Hi,

I am trying to get gpg-agent to unlock my ssh and gpg keys with my login password.

At the moment, I am running gpg-agent as a systemd --user service just like the wiki describes.
Once I have used ssh once, it will cache the password and I do not have to put it in anymore.

Now, how would I get gpg-agent unlocked via pam?
At the moment, I am trying to use this her:
https://gist.github.com/Apsu/6758891

Basically, this uses pam_exec to pass the password to a script that unlocks all the keys.
If I run this script after login, this works fine but not then I use pam to execute the script.
I see that the script gets executed but the gpg-agent is not unlocked once I have been logged in.

I already found some hints that the script might run to early and hence the service has not yet started.
I added a systemd-wait (https://github.com/Stebalien/systemd-wait) so the unlocking part of the script is only executed once the service becomes active but the problem remains.

My guess is that it is either due to a problem in the environment (seeing one during pam and seeing another after login) or because the script is executed for the wrong user.
I have no other explanation why this is not working.

Has anyone maybe a tip for me how I can fix this?