So, like many people, I was using my GPG key for SSH authentication with the help of monkeysphere, so I could load my private key to agent with monkeysphere s command and be free to connect anywhere I want without passwords.

I updated my Arch Linux box recently and discovered that GnuPG 2.0 was replaced with GnuPG 2.1 which is incompatible with monkeysphere. Allegedly GPG 2.1 brought some improvements to gpg-agent that made monkeysphere not needed anymore, however I'm having a hard time finding clear instructions on how to use them.

Could someone explain how to configure GPG 2.1 to be able to achieve the same thing, that was possible with monkeysphere (loading private key to memory once and using it in every next connection)?

2 Answers 2


I think you're looking for this bit that's covered in the ssh.com documentation, in the PGP Keys section.


SSH Secure Shell only supports the OpenPGP standard and the PGP programs conforming to it. GnuPG is used in the following instructions. If you use PGP, the only difference is that the file extension is pgp instead of GnuPGP's gpg.

To make sure that user public-key authentication is enabled, the AllowedAuthentications field both in the /etc/ssh2/sshd2_config file on Remote and the /etc/ssh2/ssh2_config file on Local should contain the word "publickey":

  AllowedAuthentications   publickey

Other authentication methods can be listed in the configuration file as well. Copy your private key ring (secring.gpg) to the ~/.ssh2 directory on Local. Create an identification file in your ~/.ssh2 directory on Local if you do not already have one. Add the following lines to the identification file:

  PgpSecretKeyFile    <filename of the user's private key ring>
  IdPgpKeyName        <name of the OpenPGP key in PgpSecretKeyFile>
  IdPgpKeyFingerprint <fingerprint of OpenPGP key in PgpSecretKeyFile>
  IdPgpKeyId          <id of the OpenPGP key in PgpSecretKeyFile>

Copy your public-key ring (pubring.gpg) to the ~/.ssh2 directory on Remote

  scp2 pubring.gpg user@remote_host:.ssh2

Create an authorization file in your ~/.ssh2 directory on Remote. Add the following lines to the authorization file:

  PgpPublicKeyFile   <filename of the user's public-key ring>
  PgpKeyName         <name of the OpenPGP key>
  PgpKeyFingerprint  <fingerprint the OpenPGP key>
  PgpKeyId           <id of the OpenPGP key>

Now you should be able to login to Remote from Local using Secure Shell. Try to login:

  Local>ssh Remote
  Passphrase for pgp key "user (comment) <user@Local>":

After you have entered the passphrase of your PGP key, a Secure Shell connection will be established.


  1. Tell your gpg-agent to enable its support for the ssh-agent protocol. You do this by starting it with --enable-ssh-support or by putting


    into ~/.gnupg/gpg-agent.conf.

  2. Tell the agent which key (or keys) you want to use for ssh authentication (note that the key must have the A (Authenticate) capability). You’ll have to find the keygrip of your key, to do this list the keys with --with-keygrip, for example:

    gpg2 --with-keygrip -k <your email>

    Paste the keygrip (or keygrips for multiple keys, one per line) into ~/.gnupg/sshcontrol.

  3. Starting with 2.1 the agent uses static paths for sockets it listens at. Just point ssh to the right socket by adding:

    export SSH_AUTH_SOCK="$HOME/.gnupg/S.gpg-agent.ssh"

    to some startup file (~/.xsession, ~/.bashrc or whichever is appropriate).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.