1

So I executed gpg --keyserver keys.gnupg.net --recv id as root and get this:

gpg: directory '/root/.gnupg' created
gpg: new configuration file '/root/.gnupg/dirmngr.conf' created
gpg: new configuration file '/root/.gnupg/gpg.conf' created
gpg: keybox '/root/.gnupg/pubring.kbx' created

It's stuck after the last line and executing it again returns nothing.
Could it be a problem with my iptables? I'm running Debian 9.1 with KDE.

I also tried gpgconf --kill gpg-agent && gpgconf --kill dirmngr, ping keys.gnupg.net (that IP (194.94.127.122) doesn't seem to be the right server though?), iptables -A OUTPUT -p tcp -d {ip} --dport 11371 -j ACCEPT

How to fix?

  • Does adding -v or even -vv give more insight? – Jens Erat Aug 5 '17 at 14:08
  • @JensErat No. But now I get "gpg: keyserver receive failed: No name". I think it might have to do with my iptables. What exactly do I need to open in the firewall to get it working? – mYnDstrEAm Aug 5 '17 at 14:30
  • @JensErat When running ping keys.gnupg.net I now get host10.slyinvestment.com (85.93.13.183). Even after changing DNS to 8.8.8.8. That can't be right or is it? I get "gpg: keyserver receive failed: No keyserver available" when running it now. But I probably need to first allow something via iptables. – mYnDstrEAm Aug 5 '17 at 14:52
  • "No name" is a pretty bad error message for nameserver errors or hostnames not having A or AAAA records in DNS. This might just be a temporary error message. – Jens Erat Aug 5 '17 at 15:37
3

The isse you describe might very well be a firewall issue (if you wait long enough, is there a timeout message?). keys.gnupg.net in fact points to pool.sks-keyservers.net (technically implemented as a CNAME alias in DNS):

$ dig CNAME keys.gnupg.net

; <<>> DiG 9.10.3-P4-Debian <<>> CNAME keys.gnupg.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63954
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1280
;; QUESTION SECTION:
;keys.gnupg.net.            IN  CNAME

;; ANSWER SECTION:
keys.gnupg.net.     81999   IN  CNAME   pool.sks-keyservers.net.

;; Query time: 1 msec
;; SERVER: 192.168.0.1#53(192.168.0.1)
;; WHEN: Sat Aug 05 17:20:28 CEST 2017
;; MSG SIZE  rcvd: 80

The SKS keyserver pool on the other hand does not consist of a single keyserver, but a whole pool of them, all synchronizing among each other. In fact, you can operate your own key server which will automatically be added to the network. This is a random selection of servers in the current pool return whenever the pool domain is queried:

$ host pool.sks-keyservers.net
pool.sks-keyservers.net has address 81.187.55.68
pool.sks-keyservers.net has address 155.94.209.99
pool.sks-keyservers.net has address 195.181.242.148
pool.sks-keyservers.net has address 37.97.128.99
pool.sks-keyservers.net has address 80.108.201.53
pool.sks-keyservers.net has address 176.9.147.41
pool.sks-keyservers.net has address 178.254.42.45
pool.sks-keyservers.net has address 130.206.1.111
pool.sks-keyservers.net has address 130.133.110.62
pool.sks-keyservers.net has address 190.202.122.122
pool.sks-keyservers.net has IPv6 address 2001:41d0:1:ac90::1
pool.sks-keyservers.net has IPv6 address 2a00:f820:177:0:84:200:66:125
pool.sks-keyservers.net has IPv6 address 2a03:b0c0:1:d0::18c2:6001
pool.sks-keyservers.net has IPv6 address 2610:81:3001:53::231
pool.sks-keyservers.net has IPv6 address 2607:5300:60:3308::1
pool.sks-keyservers.net has IPv6 address 2a01:7e00::f03c:91ff:fe69:8da9
pool.sks-keyservers.net has IPv6 address 2001:648:2ffc:1225:a800:1ff:fee4:5da4
pool.sks-keyservers.net has IPv6 address 2001:4c80:40:628:5c70:d1ff:fe44:1424
pool.sks-keyservers.net has IPv6 address 2600:3c03::f03c:91ff:fe96:bd1a
pool.sks-keyservers.net has IPv6 address 2a02:7b40:c3b5:f294::1

This also means you cannot define a firewall rule for a single static IP (not even a bunch of, as they change regularly) to connect to keys.gnupg.net.

There are a few key servers operated by well-known entities with rather stable service, for example:

  • pgp.mit.edu
  • keyserver.ubuntu.com
  • pgp.surfnet.nl
  • pgp.uni-mainz.de

If you are required to choose a single IP because of necessary firewall restrictions, you might want to go for one of them (but still they might go offline or change IPs from time to time, of course).

  • Thank you. I'm not required to choose a single IP but I'm still new to GNU/Linux. Could you tell me what iptables command I should execute or what I need to configure to get it working? I get "gpg: keyserver receive failed: No keyserver available" and when replacing keys.gnupg.net with hkp://pgp.mit.edu I get a timeout after a long while. – mYnDstrEAm Aug 5 '17 at 15:50
  • I can open the keyserver websites but when trying to get the keys via the terminal I get these errors. sudo lsof -i -P says (SYN_SENT) for dirmngr on TCP port 11371 which I allowed via iptables. I also once got "gpg: keyserver receive failed: Network is unreachable". Is this just me? How exactly can I fix it? – mYnDstrEAm Aug 5 '17 at 16:41
  • Solved it now. The issue seems to have been on the server-side. I also changed the order of some iptable-entries, making use of iptables-save and iptables-restore. – mYnDstrEAm Aug 5 '17 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.