I have my GPG keys stored on a remote server (accessible via SSH) due to some technical constraints. Is it possible to make GPG use those keys transferred over ssh, without actually copying them locally?
You can start gpg-agent
remotely and create remote UNIX socket port forwarding to your host and then use the gpg-agent
locally. In short
Connect to the server and start
gpg-agent
(if it is not running yet) and ensure it stays running. It is listening on socket defined in environment variable$GPG_AGENT_INFO
. Store the path:eval `gpg-agent --daemon` && echo $GPG_AGENT_INFO
Issue remote unix domain socket forwarding (choose secure
local_path
):ssh -NTfR local_path:remote_path_from_above remoteHost
Kill your local agent and start new one with connection to the remote host:
export GPG_AGENT_INFO=local_path gpg-connect-agent /bye &>/dev/null || gpg-agent --daemon &>/dev/null
Based on the knowledge gained in the related question.
-
A. For the socket forwarding in step 2, you need the relatively recent OpenSSH 6.7 article. For instance, Ubuntu Trusty LTS is still at 6.6. – Matei David Aug 4 '16 at 1:47
-
B. Your step 3 will start an extra
gpg-agent
running locally. I think what you meant is to rungpg
, not anothergpg-agent
. So,export GPG_AGENT_INFO=local_path; gpg --encrypt --recipient ...
. – Matei David Aug 4 '16 at 1:49 -
In this scheme, it is unclear how the remote
gpg-agent
, the only one that has access to the keys, will be able to ask for passphrases. Perhapspinentry-curses
might work (not sure), but anything GUI-related can't possibly work. – Matei David Aug 4 '16 at 1:53