Arch Linux

BBT

Member

From: Ghent

Registered: 2011-10-27

Posts: 11

Website

[SOLVED] gpg-agent no longer spawning pin-entry after update

Hi all, today I updated my system (pacman -Syu) and after reboot it turns out my previously functional gpg-agent for SSH is no longer working. I've dug around quite a bit, but can't seems to hit the nail.

Versions:

➜  ~ gpg-agent --version
gpg-agent (GnuPG) 2.1.21
libgcrypt 1.7.7
Copyright (C) 2017 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

➜  ~ systemctl --version
systemd 232
+PAM -AUDIT -SELINUX -IMA -APPARMOR +SMACK -SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD +IDN

Working confguration before the update:

# /home/bbt/.gnupg/gpg-agent.conf 
default-cache-ttl 3600
enable-ssh-support
allow-loopback-pinentry

SSH key-pair lives in the standard

~/.ssh/{id_rsa,id_rsa.pub}

location.

with a systemd unit file:

# /home/bbt/.config/systemd/user/gpg-agent.conf
Description=GnuPG private key agent
IgnoreOnIsolate=true

[Service]
Type=forking
ExecStart=/usr/bin/gpg-agent --daemon --enable-ssh-support
ExecStop=/usr/bin/pkill gpg-agent
Restart=on-abort

[Install]
WantedBy=multi-user.target

This behaved as expected - ssh-ing/git actions spawned pinentry for my passphrase, which was indeed cached for an hour.

Broken situation
Now, after the update my XFCE session broke - didn't load desktop/panels, only the blue/grey background + cursor. After some trial and error it turned out that the systemd unit file above was the culprit, so I moved that and now my session does load.

However, in this current situation, it looks like a shipped gpg-agent unit file is used:

➜  ~ systemctl --user status gpg-agent
● gpg-agent.service - GnuPG cryptographic agent and passphrase cache
   Loaded: loaded (/usr/lib/systemd/user/gpg-agent.service; static; vendor preset: enabled)
   Active: active (running) since Wed 2017-06-28 21:22:11 CEST; 11min ago
     Docs: man:gpg-agent(1)
 Main PID: 4307 (gpg-agent)
   CGroup: /user.slice/user-1000.slice/user@1000.service/gpg-agent.service
           └─4307 /usr/bin/gpg-agent --supervised

Jun 28 21:22:11 rheia systemd[3948]: Started GnuPG cryptographic agent and passphrase cache.
Jun 28 21:22:11 rheia gpg-agent[4307]: gpg-agent (GnuPG) 2.1.21 starting in supervised mode.
Jun 28 21:22:11 rheia gpg-agent[4307]: using fd 3 for extra socket (/run/user/1000/gnupg/S.gpg-agent.extra)
Jun 28 21:22:11 rheia gpg-agent[4307]: using fd 4 for browser socket (/run/user/1000/gnupg/S.gpg-agent.browser)
Jun 28 21:22:11 rheia gpg-agent[4307]: using fd 5 for ssh socket (/run/user/1000/gnupg/S.gpg-agent.ssh)
Jun 28 21:22:11 rheia gpg-agent[4307]: using fd 6 for std socket (/run/user/1000/gnupg/S.gpg-agent)
Jun 28 21:22:11 rheia gpg-agent[4307]: listening on: std=6 extra=3 browser=4 ssh=5

Contents of that unit file are different from the one that worked for me:

[Unit]
Description=GnuPG cryptographic agent and passphrase cache
Documentation=man:gpg-agent(1)
Requires=gpg-agent.socket
After=gpg-agent.socket
## This is a socket-activated service:
RefuseManualStart=true

[Service]
ExecStart=/usr/bin/gpg-agent --supervised
ExecReload=/usr/bin/gpgconf --reload gpg-agent

What caught my attention was the missing

--enable-ssh-support

, BUT going by the wiki that should be covered by the config in

~/.gnupg/gpg-agent.conf

.

The current situation is that every ssh action prompts for my pass-phrase, unless I

ssh-add

first. No pinentry is seen, ever.

Possibly relevant - my ~/.zshrc contains:

# Set GPG TTY
export GPG_TTY=$(tty)

# Refresh gpg-agent tty in case user switches into an X session
gpg-connect-agent updatestartuptty /bye >/dev/null

Any ideas?

Last edited by BBT (2017-06-28 20:03:47)

Scimmia

Fellow

Registered: 2012-09-01

Posts: 13,729

Re: [SOLVED] gpg-agent no longer spawning pin-entry after update

Get rid of your custom service file and things will probably work again.

BBT

Member

From: Ghent

Registered: 2011-10-27

Posts: 11

Website

Re: [SOLVED] gpg-agent no longer spawning pin-entry after update

It's no longer using the custom service file but the vendor service file, since the custom service file caused my xfce session to not properly start.

BBT

Member

From: Ghent

Registered: 2011-10-27

Posts: 11

Website

Re: [SOLVED] gpg-agent no longer spawning pin-entry after update

Possible extra information: ssh-add is indeed not aware of my keys:

~ ssh-add -l
The agent has no identities

BBT

Member

From: Ghent

Registered: 2011-10-27

Posts: 11

Website

Re: [SOLVED] gpg-agent no longer spawning pin-entry after update

Ah, just discovered that ssh-agent was running, started by the xfce4-session. Could be update related, could be my own stupidity. I disabled it (docs: http://docs.xfce.org/xfce/xfce4-session … pg_agents), relogged and now it's all working the way it should.