3

I have my GPG keys stored on a remote server (accessible via SSH) due to some technical constraints. Is it possible to make GPG use those keys transferred over ssh, without actually copying them locally?

Improve this question
2

You can start gpg-agent remotely and create remote UNIX socket port forwarding to your host and then use the gpg-agent locally. In short

  1. Connect to the server and start gpg-agent (if it is not running yet) and ensure it stays running. It is listening on socket defined in environment variable $GPG_AGENT_INFO. Store the path:

    eval `gpg-agent --daemon` && echo $GPG_AGENT_INFO

  2. Issue remote unix domain socket forwarding (choose secure local_path):

    ssh -NTfR local_path:remote_path_from_above remoteHost

  3. Kill your local agent and start new one with connection to the remote host:

    export GPG_AGENT_INFO=local_path
gpg-connect-agent /bye &>/dev/null || gpg-agent --daemon &>/dev/null

Based on the knowledge gained in the related question.

Improve this answer
3
  • A. For the socket forwarding in step 2, you need the relatively recent OpenSSH 6.7 article. For instance, Ubuntu Trusty LTS is still at 6.6.
    – Matei David
    Aug 4 '16 at 1:47
  • B. Your step 3 will start an extra gpg-agent running locally. I think what you meant is to run gpg, not another gpg-agent. So, export GPG_AGENT_INFO=local_path; gpg --encrypt --recipient ....
    – Matei David
    Aug 4 '16 at 1:49
  • In this scheme, it is unclear how the remote gpg-agent, the only one that has access to the keys, will be able to ask for passphrases. Perhaps pinentry-curses might work (not sure), but anything GUI-related can't possibly work.
    – Matei David
    Aug 4 '16 at 1:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.