2

Adding to this question:

How do I close gnupg V2.0 smartcard after signing an rpm?

I tried to execute:

gpg-agent --default-cache-ttl 15 --max-cache-ttl 15 --daemon

But after 15 seconds, if I execute again a signature, gpg2 doesn't prompt for the PIN.

The only solution I've found so far, is to unplug/plug smartcard on the reader.

0

Starting gpg-agent with those parameters probably gives you a message:

gpg-agent: gpg-agent running and available

You are not changing that running session, and that is what caches your PIN. That session is (at least on my Ubuntu 12.04 system) started by the gnome-session, effectively by the script /etc/X11/Xsession.d/90gpg-agent. On my system it doesn't seem that that file allows for any dynamic commandline option setting for gpg-agent, so you might have to hardcode those options in there.

You can of course also kill and restart the gpg-agent, that will let you get rid of the cached pins as well. Just make sure the output of the command goes to the file where the original invocation of gpg-agent puts it (on my system ~/.gnupg/gpg-agent-info-<hostname>).

At some point my bank's software forced me to take out the smartcard, as a protective measure, after providing my signature/pin. As their software was running on a VirtualMachine, I would just temporarily virtually remove the USB (on which the CardReader was connected) from the host (using a small python script). That would work for you as well if you would be running on a VM.

  • It's only for my test that i run gpg-agent manualy. I have a client VM, but the reader is plugged on esx-server on closed room. – usergfo Jul 10 '14 at 14:40
  • @usergfo If you run the gpg-agent manually, than you should just stop (killall -SIGHUP gpg-agent) and restart. I would not know how you can do the Python-disconnect-virtual USB trick on the ESX host. – Anthon Jul 10 '14 at 15:11
  • Thanks for yor help. It work fine. I have only 1 prompt per RPM signature. – usergfo Jul 11 '14 at 8:34
  • @usergfo Can you accept and/or vote on the answers I gave if appropriate, then others don't have read through the comments to see if an answer is appropriate (and I get some reputation increase ;-) ) – Anthon Jul 11 '14 at 9:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.