Arch Linux

DeltaXFX

Member

From: USA

Registered: 2006-08-01

Posts: 74

Script to clear cached gpg-agent passphrase?

Hello,
I recently setup enigmail with thunderbird so I can sign and encrypt email. I had an issue with the passphrase being cached by seahorse, and was unable to find a setting to change the time. Doing a lot of searching I found that setting "use-agent" in ~/.gnupg/gpg.conf and setting appropriate timeouts in ~/.gnupg/gpg-agent.conf was supposed to work. But after many, many failed attempts, I switched from gnome to xfce and got rid of seahorse (probably making this far more complicated than I needed to, but I like xfce, too). As soon as I did that the timeouts I set in gpg-agent.conf started working correctly. Currently using 300 seconds. I would like to extend this time to 10 or 20 minutes to save the password hassle while going through emails, but would like an "easy" way to clear the cached passphrase when I'm finished. I always lock my desktop when I'm away, but would prefer to know my signature and key passphrase is no longer cached when I get up.
I found this in the kde wiki:
killall gpg-agent    -stops all instances

eval "$(gpg-agent --daemon)"     -will restart the agent

gpg-agent status     -should tell you if the agent is running.

If I execute eval "$(gpg-agent --daemon)" nothing seems to happen, I can click any message and it decrypts without asking for my passphrase (as long as the 5 minute timeout hasn't expired of course).

If I kill gpg-agent, and then use eval "$(gpg-agent --daemon)" to start it back up, when I click on an encrypted message in thunderbird I get this error in the signature banner "Error - signature verification failed; click on 'Details' button for more information"

OpenPGP security info reveals the following:

Error - signature verification failed

gpg command line and output:
/usr/bin/gpg
can't connect to `/tmp/gpg-ZoVzCT/S.gpg-agent': No such file or directory
gpg: can't connect to `/tmp/gpg-ZoVzCT/S.gpg-agent': connect failed
gpg: can't query passphrase in batch mode
gpg: Invalid passphrase; please try again ...
gpg: can't query passphrase in batch mode
gpg: Invalid passphrase; please try again ...
gpg: can't query passphrase in batch mode
gpg: encrypted with 4096-bit RSA key, ID XXXXXXX, created 2012-XXXX
      "XXXXXX <XXXXXX>"
gpg: encrypted with 4096-bit RSA key, ID XXXXXXX, created 2012-XXXX
      "XXXXXX <XXXXXX>"
gpg: public key decryption failed: bad passphrase
gpg: decryption failed: secret key not available

Restarting thunderbird doesn't help. Restarting the computer fixes it. It looks like when gpg-agent starts it creates a gpg-RANDOM temp directory, and when I restart it that changes, but enigmail doesn't pick this up even after restarting thunderbird. How does it figure it out on a fresh start?
Is there anyway to simply clear the gpg-agent cached passphrase and then be able to use it again (supply the password) without having to restart the computer?

Thanks!

---

The Internet...? Is that thing still around?

kylehuff

Member

Registered: 2013-02-02

Posts: 1

Re: Script to clear cached gpg-agent passphrase?

Send a SIGHUP signal to the gpg-agent process. This will clear all stored passphrases.

pkill -SIGHUP gpg-agent