1

I have two hosts, A and B. On A I have the gpg pinentry program setup to be pinentry-curses but I have no idea how I did it anymore. I can not seem to find the difference between A and B, but on A (which has no GUI) I can not get gpg to use pinentry-curses. On B it doesn't seem to matter whether I am at a terminal, a console, or have ssh'd to another host and back. I always get pinentry-curses. On A every operation fails due to inability to enter a pin.

I don't know what else to check. Here is everything I've tried looking at.

First, the pinentry symlink:

me@b ~ % ls -l $(dirname $(which pinentry)) | grep pinentry
lrwxrwxrwx 1 root root            14 Dec  8 00:29 pinentry -> pinentry-gtk-2
-rwxr-xr-x 1 root root         60832 Dec  8 00:29 pinentry-curses
-rwxr-xr-x 1 root root         48256 Dec  8 00:29 pinentry-emacs
-rwxr-xr-x 1 root root         65088 Dec  8 00:29 pinentry-gnome3
-rwxr-xr-x 1 root root         73792 Dec  8 00:29 pinentry-gtk-2
-rwxr-xr-x 1 root root        103280 Dec  8 00:29 pinentry-qt
-rwxr-xr-x 1 root root         52416 Dec  8 00:29 pinentry-tty

me@b ~ % diff <(ssh a 'ls $(dirname $(which pinentry)) | grep pinentry') <(ls $(dirname $(which pinentry)) | grep pinentry)

My gpg.conf files are the same (modulo comments and blank lines):

me@b ~ % diff <(ssh a "egrep -v '^#|^$' ~/.gnupg/gpg.conf") <(egrep -v '^#|^$' ~/.gnupg/gpg.conf)  

The contents of my ~/.gnupg folders appears to not differ in any significant way

me@b ~ % diff <(ssh a ls -R ~/.gnupg) <(ls -R ~/.gnupg)
2c2
< S.gpg-agent
---
> crls.d
8a9
> S.gpg-agent
9a11,13
> 
> /home/me/.gnupg/crls.d:
> DIR.txt

Neither have a gpg-agent.conf file:

me@b ~ % ls ~/.gnupg/gpg-agent.conf
ls: cannot access '/home/me/.gnupg/gpg-agent.conf': No such file or directory
me@b ~ % ssh a ls ~/.gnupg/gpg-agent.conf
ls: cannot access '/home/me/.gnupg/gpg-agent.conf': No such file or directory

Both have pinentry-curses installed:

me@b ~ % pacman -Ql pinentry | grep -i pinentry-curses
pinentry /usr/bin/pinentry-curses
me@b ~ % ssh a 'pacman -Ql pinentry | grep -i pinentry-curses'
pinentry /usr/bin/pinentry-curses

My environment appears to be roughly the same:

me@b ~ % env | egrep -i 'ssh|gpg|pgp|pinentry'
SSH_AGENT_PID=519
SSH_AUTH_SOCK=/tmp/ssh-yC9qsRh9Uf2c/agent.518
me@b ~ % ssh a "env | egrep -i 'ssh|gpg|pgp|pinentry'"
SSH_CLIENT=192.168.1.10 54816 22
SSH_CONNECTION=192.168.1.10 54816 192.168.1.2 22

And the gpg-agents on both hosts are invoked with the same args:

me@b ~ % cat /proc/$(pgrep gpg-agent)/cmdline
gpg-agent--homedir/home/me/.gnupg--use-standard-socket--daemon%
me@b ~ % ssh a 'cat /proc/$(pgrep gpg-agent)/cmdline'
gpg-agent--homedir/home/me/.gnupg--use-standard-socket--daemon%
  • Is $DISPLAY set in your sessions on either host? – Stephen Kitt May 6 '16 at 7:24
  • @Stephen Kitt On A I only have SSH access and $DISPLAY is not set. On B (in a window) $DISPLAY is set and pinentry-gtk is used. On B (in a tty) $DISPLAY is not set and pinentry-curses is used. – Huckle May 6 '16 at 16:03
1

GnuPG uses a pluggable and configurable pinentry implementation, usually through symlinks on /usr/bin/pinentry or similar solutions.

On Debian and derivatives shipping the update-alternative system, you can display which one is setup running

update-alternatives --display pinentry

and change it through

update-alternatives --config pinentry

If you "messed up" manually, have a look where pinentry points to:

ln -l `which pinentry`

(you might have to recursively resolve symlinks, though).

  • 4
    That's not a GnuPG feature, it's a feature of the GnuPG packaging in Debian (and derivatives). – Stephen Kitt May 6 '16 at 9:01
  • Both A and B are Arch. Symlinks where already posted in the question. – Huckle May 6 '16 at 16:05
  • I remembered having read that up in the GnuPG manual at some time, but you're right. I'll leave it around but add a note on the restriction. – Jens Erat May 7 '16 at 7:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.