1) How do I know which servers are used to search for keys with gpg
gpg --search-key <keyword>
2) How to add a server to the list of queried server?
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community“Reputable” key servers exchange key updates with others, so using one is the same as using another (with slight delays in some cases). In the past, the recommendation was to use the SKS server pool, ideally using a secure connection; see the previous link for details, or this answer. However the pool has been disabled.
As of GPG 2.3.2 the default is to use keyserver.ubuntu.com; to do that with older releases, use:
gpg --keyserver keyserver.ubuntu.com --search-key ...
If you’re using that version or a later one, and you haven’t changed its default configuration, you’re good to go without specifying a key server manually.
If necessary, you can store the keyserver setting permanently by adding the relevant option to ~/.gnupg/dirmngr.conf
(you may need to run gpgconf --reload dirmngr
if the dirmngr
daemon is already running):
keyserver hkps://keyserver.ubuntu.com
You can specify multiple keyserver
options in that file, but I get the impression that only the last one is taken into account.
To actually answer your initial question, at least version 2.1 of GPG shows the key server used for a query:
$ gpg --search-key A36B494F
gpg: data source: https://host-37-191-236-118.lynet.no:443
...
dirmngr
have been patched so that <hkps://keys.openpgp.org> (a more privacy-conscious and stricter key-server that is less susceptible to attacks) is the default keyserver if none is explicitly configured. I believe newer versions of Fedora may also be using the same default keyserver.
Dec 21, 2021 at 20:31
$ gpg -v --recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3
gpg: data source: https://162.213.33.8:443
gpg: armor header: Version: Hockeypuck ~unreleased
gpg: armor header: Comment: Hostname:
gpg: key 3804BB82D39DC0E3: number of dropped non-self-signatures: 108
gpg: pub rsa4096/3804BB82D39DC0E3 2014-10-28 Michal Papis (RVM signing) <[email protected]>
gpg: key 3804BB82D39DC0E3: "Michal Papis (RVM signing) <[email protected]>" not changed
gpg: Total number processed: 1
gpg: unchanged: 1
The "data source" line tells which server was used.
This was run under Arch Linux, and for some reason (to be specific which server replied?) it doesn't tell the domain (under Debian it does), but you can do:
$ host 162.213.33.8
8.33.213.162.in-addr.arpa domain name pointer keyserver.ubuntu.com.
Alternatively you can inspect the source code. For Arch Linux, it uses the official version which switched to keyserver.ubuntu.com in 2.2.29
, and 2.3.2
. Debian is using keys.openpgp.org
since 2.2.17
(there's also supposedly a non-released branch for 2.2.12
).
As for adding keyservers to the list, you can make use of $GNUPGHOME/dirmngr.conf
:
keyserver keys.openpgp.org
Make sure to gpgconf --reload dirmngr
(or gpgconf --kill dirmngr
) for the changes to take effect.
These 2 seem to be the recommended keyservers. See also this answer.
I decided to leave this part, just in case
A way to find it out with strace
:
$ pkill dirmngr; strace -fs 1024 gpg --recv-keys 7D2BAF1CF37B13E2069D6956105BD0E739499BDB |& grep resolve_dns_addr
[pid 15102] write(2, "dirmngr[15101.5]: resolve_dns_addr for 'keys.openpgp.org': 'keys.openpgp.org' [already known]", 93) = 93
[pid 15102] write(2, "dirmngr[15101.5]: resolve_dns_addr for 'keys.openpgp.org': 'keys.openpgp.org' [already known]", 93) = 93
You need to kill dirmngr
first, because it's it that interacts with keyservers, and if it's already running you won't be able to inspect what it's doing.
-f
- trace child processes, -s
- maximum string size to print (the default is 32).
hkps://keys.openpgp.org
as the default key-server. Unlike the traditional HKP protocol which uses port 11371 (and can be blocked by corporate firewalls), it uses TLS (on port 443). I’d also say there’s no need to kill a running dirmngr
process. Instead, you can get the running process to reload its configuration by running gpgconf --reload dirmngr
.
Dec 21, 2021 at 21:01
This will list all keyservers dirmngr
is currently using, starting it if necessary.
gpg-connect-agent --dirmngr 'keyserver' /bye
gpg-agent
processes running for some reason and it's connecting to the wrong one. If you want to start fresh, try running killall -v gpg-agent
and then look into why you might have had more than one running.
Jun 7 at 18:06