Arch Linux

18kimn

Member

Registered: 2022-07-21

Posts: 1

fprint and gpg unlocking

Hi all,

I'm wondering if there is a way to integrate fprint and gpg unlocking, the way that fprint can be used in place of regular user password inputs.

The only method I could think of is to place a plain-text password for a gpg key into a file behind read-only access for root, then enable fprint authentication for sudo. A user could unlock a gpg key with their fingerprint then by doing:

pass=$(sudo cat /path/to/read-protected/pass)
gpg --pinentry-mode loopback --passphrase $pass -d path/to/gpg-encrypted/item.gpg

Thus effectively replacing GPG protection with just the protections offered by file permissions. However, this is obviously not very good practice for anything secure, and also not very ergonomic overall, so I was wondering if there have been efforts to integrate the two systems like there have been for authenticating Linux user accounts. I also suspect this may not be possible due to the encrypted nature of GPG-protected items, but am not sure.

Please let me know of any thoughts and suggestions!

Last edited by 18kimn (2022-07-21 04:59:40)