6

I'm using Fedora 24 (amd64), which is running GNOME 3/GNOME Shell as a desktop environment, using Wayland as the display server, and SystemD as the init. Pretty standard, out of the box, this is the way Fedora 24 ships.

My previous distribution was still using X, so I had a script called 90-gpg-agent in /etc/X11/Xsession.d/autostart which conditionally started gpg-agent or sourced its exported variables, making them available to graphical programs that started. This made it so that programs like unison-gtk would have the correct SSH_AUTH_SOCK environment variable so they could use gpg-agent as the SSH agent. Anything running inside a bash session would just use the environment variables in my .bashrc, but graphical applications needed this to be exported for access.

Is there an equivalent for Wayland/GNOME/SystemD which will export these environment variables and provide them to applications starting in that display server+desktop environment?

Improve this question

3 Answers 3

Reset to default
4

Try using systemctl --user import-environment SSH_AUTH_SOCK in a script in /etc/X11/xinit/xinitrc.d/. Check out /etc/X11/xinit/xinitrc.d/50-systemd-user.sh for reference.

Improve this answer
3

Simply enable ssh support in your gpg agent – add the line enable-ssh-agent to ~/.gnupg/gpg-agent.conf – and log out (and back in).

This setting is picked up by /etc/X11/Xsession.d/90gpg-agent.

The problem is that this only works for X11 programs – native Wayland clients are not affected. To fix that, there are two options, depending on what gpgconf --list-dirs agent-ssh-socket prints:

  • if it's a fixed path, create a file .config/environment.d/ssh.conf and add that output:

    SSH_AUTH_SOCK=/run/user/XXX/gnupg/S.gpg-agent.ssh

    or whatever else gpgconf happens to print.

  • if it's a temporary file that's somewhere else the next time you log in, add these lines to your .bashrc (or the equivalent of whichever shell you're using):

    if [ -z "$SSH_AUTH_SOCK" ] ; then
    export SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)"
fi
dbus-update-activation-environment --systemd SSH_AUTH_SOCK

    This only works for shells, and other Wayland programs you start after the first shell, but that should be sufficient.

Improve this answer
0

A bit too late, but this may help someone else.

According to the Gnome keyring SSH agent Wiki page you can disable the SSH agent support in Gnome keyring.

Here is the relevant information copied and pasted from that source:

As a system distributor or a user, if you use another SSH agent (such as the ssh-agent included with OpenSSH), you may want to disable the SSH agent in GNOME Keyring to prevent SSH from using it instead of your preferred SSH agent.

There are several ways to disable the GNOME keyring SSH agent:

  • Use the "Startup Applications" capplet (ie: gnome-session-properties) and disable the "SSH Key Agent" startup program.
  • Build gnome-keyring without SSH support. Use the following configure option 
    $ ./configure --disable-ssh-agent
  • If you're starting gnome-keyring manually or from a script you can use the --components option to exclude starting up the SSH support. 
    $ gnome-keyring-daemon --components keyring,pkcs11
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .