I have my GPG keys stored on a remote server (accessible via SSH) due to some technical constraints. Is it possible to make GPG use those keys transferred over ssh, without actually copying them locally?
2
You can start gpg-agent remotely and create remote UNIX socket port forwarding to your host and then use the gpg-agent locally. In short
Connect to the server and start
gpg-agent(if it is not running yet) and ensure it stays running. It is listening on socket defined in environment variable$GPG_AGENT_INFO. Store the path:eval `gpg-agent --daemon` && echo $GPG_AGENT_INFOIssue remote unix domain socket forwarding (choose secure
local_path):ssh -NTfR local_path:remote_path_from_above remoteHostKill your local agent and start new one with connection to the remote host:
export GPG_AGENT_INFO=local_path gpg-connect-agent /bye &>/dev/null || gpg-agent --daemon &>/dev/null
Based on the knowledge gained in the related question.
-
A. For the socket forwarding in step 2, you need the relatively recent OpenSSH 6.7 article. For instance, Ubuntu Trusty LTS is still at 6.6. – Matei David Aug 4 '16 at 1:47
-
B. Your step 3 will start an extra
gpg-agentrunning locally. I think what you meant is to rungpg, not anothergpg-agent. So,export GPG_AGENT_INFO=local_path; gpg --encrypt --recipient .... – Matei David Aug 4 '16 at 1:49 -
In this scheme, it is unclear how the remote
gpg-agent, the only one that has access to the keys, will be able to ask for passphrases. Perhapspinentry-cursesmight work (not sure), but anything GUI-related can't possibly work. – Matei David Aug 4 '16 at 1:53
