I have my GPG keys stored on a remote server (accessible via SSH) due to some technical constraints. Is it possible to make GPG use those keys transferred over ssh, without actually copying them locally?


You can start gpg-agent remotely and create remote UNIX socket port forwarding to your host and then use the gpg-agent locally. In short

  1. Connect to the server and start gpg-agent (if it is not running yet) and ensure it stays running. It is listening on socket defined in environment variable $GPG_AGENT_INFO. Store the path:

    eval `gpg-agent --daemon` && echo $GPG_AGENT_INFO
  2. Issue remote unix domain socket forwarding (choose secure local_path):

    ssh -NTfR local_path:remote_path_from_above remoteHost
  3. Kill your local agent and start new one with connection to the remote host:

    export GPG_AGENT_INFO=local_path
    gpg-connect-agent /bye &>/dev/null || gpg-agent --daemon &>/dev/null

Based on the knowledge gained in the related question.

  • A. For the socket forwarding in step 2, you need the relatively recent OpenSSH 6.7 article. For instance, Ubuntu Trusty LTS is still at 6.6. Aug 4 '16 at 1:47
  • B. Your step 3 will start an extra gpg-agent running locally. I think what you meant is to run gpg, not another gpg-agent. So, export GPG_AGENT_INFO=local_path; gpg --encrypt --recipient .... Aug 4 '16 at 1:49
  • In this scheme, it is unclear how the remote gpg-agent, the only one that has access to the keys, will be able to ask for passphrases. Perhaps pinentry-curses might work (not sure), but anything GUI-related can't possibly work. Aug 4 '16 at 1:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.