1

I generated a PGP key with GnuPG over a year ago. Since I haven't had to really touch it since, I'm extremely foggy on the ins and outs of GPG (though I understand asymmetric key encryption in principle). I had used this key to authenticate SSH logins, right up until accidentally deleted it yesterday. So, today, I set out to generate it again.

I run gpg --export-secret-key -a "Ryan Lue" > ~/.ssh/id_rsa, and it prompts me for a password. I enter the password, and out comes the id_rsa file. Now, when I try to SSH into my servers, it throws the following warning:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0644 for 'id_rsa' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.

So, I obediently chmod 600 ~/.ssh/id_rsa. Then, I try again, and it prompts for a password (actually, since I'm on a Mac, Keychain prompts me for a password). I enter the same password I used to export it, and each time, it fails, spitting out the following error on the command line:

Saving password to keychain failed

I've also tried adding the key using ssh-agent, and that actually prompts me for the password on the command line:

Enter passphrase for /Users/rlue/.ssh/id_rsa:

Either way, it keeps rejecting the password. I'm 100% sure I'm entering the same passphrase at these prompts as I do to export it: I've successfully exported the key about a dozen times and failed to authenticate it in use about four dozen times.

What am I missing?

5

OpenPGP (as implemented by GnuPG) and SSH do not share a common key format, although they rely on the same cryptographic principles.

GnuPG implements the ssh-agent protocol, though, so you can still use your OpenPGP keys through GnuPG for SSHing into other computers.

  1. enable the ssh-agent protocol by adding enable-ssh-support to ~/.gnupg/gpg-agent.conf
  2. export SSH_AUTH_SOCK=$HOME/.gnupg/S.gpg-agent.ssh; you might want to do that in your ~/.profile
  3. kill ssh-agent if started and reload gpg-agent (gpg-connect-agent reloadagent /bye)
  4. export and add your public key to target servers (ssh-add -L should now contain the familiar SSH public key line for your OpenPGP key)
  5. ssh to the target server as with a normal SSH key

This also works great with OpenPGP smartcards or USB dongles, I'm using this to protect my SSH key with a YubiKey.

  • Thank you Jens! Somehow I missed your answer until now, and discovered all these things the hard way myself. :\ There were some additional steps that I needed to do to make it work (like adding the authentication key keygrip to ~/.gnupg/sshcontrol rather than exporting it); I documented the process on my blog in case anyone else runs into the same problem. – Ryan Lue Jun 29 '17 at 10:26
1

1) I don't see any option in gpg called --export-secret-key.

2) The key would probably have different format then expected by the ssh. You will most probably need to convert it to the format understood by OpenSSH. Update the question with the information in which format the key is.

  • 1) --export-secret-key is an alias for --export-secret-keys. It's not listed in the man page, but you can try it and see that it works yourself. 2) Thanks. gnupg.org states that gpg-agent can substitute ssh-agent, so I'm exploring that path atm... – Ryan Lue Jun 28 '17 at 11:31
  • 1) thanks for clarification. 2) It can substitute the ssh-agent for ssh-agent operations, but the format of used keys can be different. – Jakuje Jun 28 '17 at 11:33
  • 2) All of these similarly named projects, products, and protocols are making my head spin. It appears that SSH protocol v2 has supported PGP key authentication since 2002 (although configuration is different from SSH1-style ~/.ssh/authorized_keys); whether that means OpenSSH does, I'm still not sure. – Ryan Lue Jun 28 '17 at 11:39
  • So do not make your life harder with gpg-agent generate simple ssh key and use it. The GPG keys were supported in some ancient versions of SSH, but they are certainly not supported now. – Jakuje Jun 28 '17 at 11:43
  • This is working functionality provided by GnuPG 2.1 (the latest version), documented from at least as far back as 2012. You're right that it would be easier to just generate a separate SSH key, though. – Ryan Lue Jun 28 '17 at 12:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.