6

I am trying to set up gpg-agent

When I log in to my machine (via SSH) and invoke gpg, it asks for password every time (it does not start gpg-agent automatically).

When I start gpg-agent manually using:

eval "$(gpg-agent --daemon)"

then next invocation of gpg actually launches the agent, and after typing my password once, I can then use gpg without password. Also, I see a socket has been created in $HOME/.gnupg/S.gpg-agent=

When I log out and log in again (ssh), I see the socket still exists in $HOME/.gnupg/S.gpg-agent= and ps shows that the agent is running, but every invocation of gpg asks for password, as if there was no agent.

I have added this to my .bashrc:

GPG_TTY=$(tty)
export GPG_TTY

but that does not seem to help

I find the behaviour of gpg-agent very confusing. I am familiar with ssh-agent and that behaves straightforward and understandable.

How can I use gpg-agent same way as I would use ssh-agent ?

For comparison, this is how ssh-agent behaves:

After I boot my machine and login for the first time, I launch ssh-add manually and type my pass phrase once.

Then, every time I log in to my machine (X, console, ssh, ...) I can use the agent (I don't need to type my password again). This is done by adding following line to .bashrc:

export SSH_AUTH_SOCK="$(find /tmp/ssh-*/agent.* -uid $(id -u) -type s -print -quit 2>/dev/null)"
1

2 Answers 2

Reset to default
7

gpg does not look for the socket (this is different with the new version 2.1) but for the environment variable GPG_AGENT_INFO. This is not set on log in. That is the problem. Obviously you have the option use-standard-socket in gpg-agent.conf so that the socket name is always the same.

You should set the variable in a login script run a simple script afterwards which checks whether gpg-agent is running:

export GPG_AGENT_INFO=/path/to/your/HOME/.gnupg/S.gpg-agent:42:1
gpg-connect-agent /bye &>/dev/null || gpg-agent --daemon &>/dev/null

That is the part for using gpg. For SSH you also need SSH_AUTH_SOCK. The easiest way to get both variables set is to add the line

write-env-file "${HOME}/.gpg-agent-info

to the config file gpg-agent.conf and to run this script after the above:

. "${HOME}/.gpg-agent-info"
export SSH_AUTH_SOCK

This is explaned in the gpg-agent man page.

10
  • I have added the two lines (EXPORT ... , gpg-connect-agent...)into my .bashrc and it seems to work. Could you please explain what does the :42:1 at the end of the socket mean ? And also, I don't understand the write-env-file part. Is this necessary, or is this an alternative solution to the two lines above?
    – Martin Vegter
    Dec 5, 2014 at 22:27
  • For GnuPG a static solution (the first two lines) is possible. But for the SSH part you need data from the agent. write-env-file (as the man page would have told you) makes gpg-agent dump the necessary data; thus this is necessary (for SSH). The OpenPGP part consists of ${path}:${pid}:${protocolversion}. The path is always the same (due to use-standard-socket), the PID is ignored (thus it can be any value), and the protocol version is always 1.
    – Hauke Laging
    Dec 5, 2014 at 23:04
  • I am still confused why you mix gpg-agent and SSH together. Aren't these two independent applications ?
    – Martin Vegter
    Dec 5, 2014 at 23:10
  • @MartinVegter I misread the question. gpg-agent can replace ssh-agent (see --enable-ssh-support) but it seems you don't do that (that would be on the other host anyway). So you don't need the SSH part but only the first two lines.
    – Hauke Laging
    Dec 5, 2014 at 23:40
  • 1
    @MartinVegter Is the gpg-agent process killed when you log out? Probably. A killed process cannot remember anything. That raises the question whether ssh-agent is (for whatever reason) not killed on logout. If that is the difference then the question would be: How to prevent gpg-agent from being killed (if that sounds like a good idea at all)? Maybe it has to be started with nohup.
    – Hauke Laging
    Dec 7, 2014 at 12:25
1

Sadly the solution in the other answer did not work for me. At my side gpg-agent --daemon ignores GPG_AGENT_INFO in the environment and always defines it's own new one, so each login created it's own permanently running process.

But following line did it:

for a in . .; do . "${HOME}/.gnupg/pg-agent-info.`uname -n`"; gpg-connect-agent /bye && break; gpg-agent --daemon >"${HOME}/.gnupg/pg-agent-info.`uname -n`"; done

  • This assumes that you have a $HOME/.gnupg directory. If not, create it with mkdir ~/.gnupg

Here is how it works:

  • It first sources the old output of the running agent setting
  • If this still is valid, it uses it
  • else it starts a new daemon and remembers the settings in "${HOME}/.gnupg/pg-agent-info.HOSTNAME"
  • A second loop in the for then re-reads the information
  • If two loops do not help, a third one would not either.

Please note that the hostname is built into the filename, because it may be that you share your home between different computers.

Feel free to improve to get rid of possibly ugly error outputs and possibly create the directory if it is missing.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .