7

Debian Jessie, XFCE 4.10, KeePass2, IceDove (with Enigmail)..

I'm using KeePass2 generated passwords for my gpg private key, to de/encrypt mails. Icedove is my client which uses the enigmail.

As soon as I want to de/encrypt a mail pinentry (pinentry-gtk2) pops up and I can't paste into the password field, nor can I move it - thus I'd like to have KeePass2 auto-type my long-ass password for me. Which does not work with the keyboard shortcut (working for anything else), but with a right-click in the KeePass2 entry for 'perform auto-type'.

this is slowly driving me nuts.. I've now read a ton of forum discussions - where none were really helpful and tried to alter my gpg-agent settings to use pinentry-curses. I even removed pinentry-gtk2 which rendered icedove completly incapable of de/encryption.

Any suggestions to make the auto-type feature or paste working in the pinentry window. Or an alternative pinentry?

3 Answers 3

Reset to default
4

The fact that the accepted answer uses the same procedure as described in the question suggests that there is no way to enable KeePass auto-type (or even simple copy-paste) to work with pinentry. However, this is incorrect!

As stated by others, pinentry programs for gpg-agent (such as pinentry-gtk-2) globally lock (“grab”) the keyboard. However, gpg-agent can be configured to disable this behavior with the --no-grab option – see the GPG documentation. (Note: This option has a security warning in the documentation. However, if you’re using KeePass anyway, I doubt that using pinentry without --no-grab will provide you with any additional security.)

In order to use --no-grab as a default for gpg-agent, create/edit the file ~/.gnupg/gpg-agent.conf (i. e. the file gpg-agent.conf in the .gnupg directory in your home directory) and add the line

no-grab

to it (information on gpg-agent.conf in the documentation). Thus, every time gpg-agent is started from this point on, it will use the --no-grab option and pinentry-gtk-2 will behave like a normal window (so you can perform auto-type using the keyboard shortcut, paste into the text field etc.).

2

In Keepass2, "Add Entry," and set "Title" to "GPG." Move from "Entry" tab to "Auto-Type" tab. Select "Override default sequence" and set to "{PASSWORD}".

Before you send email, open Keepass2 with Keepass2 password. Ask IceDove with Enigmail to "Send" and pinentry should appear (locking keyboard, preventing "Ctrl+V" (or any other keyboard shortcut you normally use to perform auto-type), preventing switch windows "Alt+Tab", etc.).

Use mouse to highlight "GPG" entry in Keepass2 and click "Perform Auto-Type" icon in Keepass2 (left of "Find" icon and underneath "Help" menu). As the keyboard "focus" was last on the pinentry text input box, Keepass2 will now start typing your long password for you.

Use mouse to click "OK" on pinentry. Done!

For more details on "Auto-Type" (http://keepass.info/help/base/autotype.html).

3
  • Maybe I haven't been clear, but the manual 'perform auto-type' always worked for me. It's the shortcut (CTRL+ALT+a), which ought to do the auto type, that is not working.
    – apoc
    Aug 24, 2015 at 11:44
  • 1
    @apoc: Edited answer to explicitly state that pinentry locks keyboard and prevents that shortcut from working (locked keyboard means you may only use keyboard to communicate with pinentry, not keepass2, and pinentry does not recognize Ctrl+Alt+a), hence you must use mouse as described.
    – jtd
    Aug 24, 2015 at 16:11
  • Why is this answer accepted? It merely re-states the procedure described in the question without offering any solution!
    – Socob
    Feb 28, 2016 at 18:59
0
    Debian 7.7 (Wheezy)
    Fluxbox 1.3.2-4
    KeePass2 2.28
    mono 2.10.8.1-8
    xdotool 2.20110530.1
    gnupg2 2.0.19-2+deb7u2

In my experience, KeePass2 version 2.28 is the first to auto-type into a terminal or non-gui program on Debian. I can auto-type into ssh or pinentry-curses from KeePass 2.28. Auto-type fails to work with pinentry-gtk-2 when I test it. I don't use icedove, so can't test that.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .