10

Can I enter my gpg password just once and unlock all my sub keys (signing, decryption, authentication)?

At the moment, I need to enter my gpg password three times (for signing, for decryption, for authentication). This is inconvenient.

I tried to come up with a shell script.

#!/bin/bash
set -x
set -e
set +o history

signing_key=77BB3C48
encryption_key=CE998547

tempfile="$(mktemp)"
echo "test" > testfile

unset passphrase || exit 1
read -sp 'Enter password. ' passphrase ; echo

exec 3<<<"$passphrase"

gpg2 --no-tty --use-agent --batch --yes --passphrase-fd 3 --sign-with "$signing_key" --clearsign "$tempfile"
gpg2 --no-tty --use-agent --verify "$tempfile.asc"

gpg2 --no-tty --use-agent --yes --armor --recipient "$encryption_key" --encrypt "$tempfile"

exec 3<<<"$passphrase"
gpg2 --no-tty --use-agent --batch --decrypt --passphrase-fd 3 "$tempfile.asc"

But unfortunately, that way passwords gnupg-agent doesn't cache the password. Can this be fixed?

System information:

  • When not using that shell script, I have no issues with gnupg-agent. When I manually sign / decrypt a file in shell, pinentry asks for password twice, then caches it until reboot.
  • Using Debian Wheezy.
  • gpg version:

dpkg -l | grep gnupg

ii  gnupg                                        1.4.12-7+deb7u3                    i386         GNU privacy guard - a free PGP replacement
ii  gnupg-agent                                  2.0.22-3                           i386         GNU privacy guard - password agent
ii  gnupg-curl                                   1.4.12-7+deb7u3                    i386         GNU privacy guard - a free PGP replacement (cURL)
ii  gnupg2                                       2.0.22-3                           i386         GNU privacy guard - a free PGP replacement (new v2.x)

I've asked on gnupg-users mailing list a while ago, but no reply.

Perhaps this answer would work? Perhaps gpg-connect-agent is required?

  • I'm impressed: exec 3<<<"$passphrase" was new even to me... And I just threw a 250 rep bounty at the answer you quote. – Hauke Laging Feb 6 '14 at 22:27
3

There is the gnome-keyring-daemon and seahorse which makes key & password management very easy.

Basically if you're running gnome-keyring-daemon as a gpg agent, it has the ability to unlock your GPG keys automatically. It does this by maintaining a password keyring, which contains the passwords to things like web sites, GPG keys, SSH keys, etc. This password keyring is then secured with it's own password. So you unlock it, and the gnome keyring unlocks everything else.
As an added bonus, gnome-keyring-daemon has a "login" keyring, which if it's password matches your user password, the keyring is automatically unlocked when you log in.


Configuration

How to get this working? Just install gnome-keyring-daemon and seahorse. The package should do all the system configuration for you. Just make sure you're not starting another keyring daemon or GPG agent. Whichever starts last "wins", and the gnome keyring starts in the PAM stack, so extremely early.

If your GPG keys are stored in ~/.gnupg, it will automatically pick them up and act as the GPG agent for them. Same goes for SSH keys stored in ~/.ssh

The first time you try to use the private key, you'll get a dialog that looks like this: (I triggered it by a simple command line gpg -d myfile.gpg) unlock keyring
Just select "Automatically unlock this keyring whenever I'm logged in"

Now we haven't really talked about seahorse. That's because it's not strictly necessary. All this has been done with just the regular gnome-keyring-daemon. However with seahorse you can view and manage all your keys & keyrings. And if you use centralized authentication (LDAP), you'll need to use it when you change your login password to also change the password on the "login" keyring to match it.

seahorse - gpg keys


Other passwords

As alluded to earlier, gnome-keyring-daemon can also store web site passwords. Last time I checked chrome supports this, but firefox does not. However there is one trick to getting it working.
By default you'll have 2 keyrings, a "login" keyring, and a "default" keyring. The "default" keyring is the default (hence the name). But it's a separate keyring, so it doesn't automatically get unlocked. In seahorse, if you right-click the "login" keyring, there's an option to "set as default". Select this and it'll start getting used for passwords. I personally just delete the "default" one and use "login" for everything.

  • Too bad I am not a gnome user. I did sudo apt-get remove gnupg-agent and sudo apt-get install gnome-keyring seahorse. Then created a file /etc/X11/Xsession.d/999gnomekeyring with the following content. eval $(/usr/bin/gnome-keyring-daemon --start --components=gpg,pkcs11,secrets,ssh) export GNOME_KEYRING_CONTROL GNOME_KEYRING_PID GPG_AGENT_INFO SSH_AUTH_SOCK (Otherwise gnome-keyring wouldn't even start in KDE.) Now, when I run gpg -d myfile.gpg, I will be asked for the password and it will be cached, but I never was prompted with this dialog. – adrelanos Mar 13 '14 at 14:45
  • (This is bad, because I am back where I begun. The signing key will be cached separately.) (There is a new line between the eval and export line, not possible with the comment markup here.) – adrelanos Mar 13 '14 at 14:46
  • I don't use gnome for my desktop manager either. It's not required. Gnome does a lot more than just their desktop manager. You should not have to add anything to /etc/X11/Xsession.d. That is supposed to be done in the PAM stack. You should have a session optional pam_gnome_keyring.so auto_start entry in one or more files in /etc/pam.d. Unfortunately I don't use debian so I don't know which one. If that's not there then that's the issue. – Patrick Mar 13 '14 at 15:13
  • Without adding to /etc/X11/Xsession.d, ps aux | grep gnome shows that gnome-keyring-daemon does not get started. (Nevertheless, removed it.) /usr/share/doc/libpam-gnome-keyring/README.Debian says If you want to start gnome_keyring from another display manager, you need to add the following lines to the corresponding /etc/pam.d/?dm file: auth optional pam_gnome_keyring.so session optional pam_gnome_keyring.so auto_start (newlines removed by se comments). Did that, added to /etc/pam.d/kdm, restarted kdm. No agent load, none available. – adrelanos Mar 13 '14 at 20:43
  • I'm at a loss. If you're using kdm and you put it in /etc/pam.d/kdm, that should have done it. The only thing I can suggest if you still want to pursue this route is to dig through logs. Sorry for the false hope, thought this would be a simple solution for you. – Patrick Mar 13 '14 at 23:50
0

I have done some investigation and the result is surprising to me but simple:

When called this way gpg doesn't communicate with gpg-agent at all! gpg is capable of doing all these operations on its own.

But if gpg-agent doesn't even know that something has happened then it can hardly know a passphrase it didn't know before.

  • Looks like I discovered a way, how this cannot be solved. – adrelanos Feb 7 '14 at 18:58
  • My original question is still open. (Which is Can I enter my gpg password just once and unlock all my sub keys (signing, decryption, authentication)?) I hope piping the password into gpg-agent or gpg-connect-agent is somehow possible. – adrelanos Feb 7 '14 at 19:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.