13

I'm seeking to cache passphrases for use on an unattended machine. As doing this poses some risk, I'd prefer choosing which passphrases get cached and avoid setting both default-cache-ttl and max-cache-ttl to obnoxiously high values as well as avoid needing to clear gpg-agent's entire cache periodically - hence I'm looking for a solution with gpg-preset-passphrase. Some of the information I found while troubleshooting refer to older versions of GnuPG so I'm unsure if I have sufficiently accounted for all the differences.

First, as prescribed by man 1 gpg-agent, I have export GPG_TTY=$(tty) in my .bashrc.

Now suppose I run eval $(gpg-agent --daemon --allow-preset-passphrase --default-cache-ttl 1 --max-cache-ttl 31536000) to start gpg-agent, noting that gpg-preset-passphrase still honors --max-cache-ttl (default 2 hours).

I then get the keygrip $KEYGRIP of the desired secret subkey with gpg --with-keygrip -K.

With that I try /path/to/gpg-preset-passphrase -c $KEYGRIP. Upon hitting return, this prints: 

   gpg-preset-passphrase: caching passphrase failed: Not implemented

Attempting again adding --verbose --debug 6 --log-file /path/to/gpg-agent.log to gpg-agent, my log is appended with

   gpg-agent[4206] listening on socket /run/user/1000/gnupg/S.gpg-agent
   gpg-agent[4207] gpg-agent (GnuPG) 2.1.15 started
   gpg-agent[4207] handler 0x7f86ef783700 for fd 5 started
   gpg-agent[4207] command PRESET_PASSPHRASE failed: Not implemented
   gpg-agent[4207] handler 0x7f86ef783700 for fd 5 terminated

I'm unsure where to proceed from this apart from diving deeper into the source, so I'm wondering if anyone can first correct the steps I'm taking.

3

2 Answers 2

Reset to default
4

It sounds like you want to send the passphrase to gpg-preset-passphrase over stdin, without echoing it (to avoid exposing it in process list):

/path/to/gpg-preset-passphrase -c $KEYGRIP <<< $PASSPHRASE

If you care about portability outside of bash:

/path/to/gpg-preset-passphrase -c $KEYGRIP <<EOF
$PASSPHRASE
EOF

This answer about "Here Documents" syntax (EOF) was invaluable to me: https://unix.stackexchange.com/a/88492

You also need allow-preset-passphrase in your ~/.gnupg/gpg-agent.conf as mentioned by holms.

If you're looking to do this with symmetric encryption (since I already lost my sanity to this, maybe you won't have to), see my answer here w.r.t. finding the right keygrip/cacheid to use to preset the passphrase in gpg-agent: https://superuser.com/a/1485486/1093343

2
  • The -c is not mentioned anywhere. I think you meant to use --preset
    – smac89
    Nov 13 at 16:59
  • 1
    @smac89 It's mentioned in the usage docs from /path/to/gpg-preset-passphrase --help (in my installation at least), this outputs -c, --preset preset passphrase. So -c is synonymous with --preset here, I used it for parity with the original question which uses -c.
    – evnp
    Nov 20 at 20:04
0

I've also got this problem and I've solved by adding configuration to gpg-agent, you can find it in here:

https://stackoverflow.com/questions/49491679/how-to-enter-gnupg-agent-key-passhprase-from-cli

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .