30

This error has arise when I add gns repository and try to use this command:

#sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys F88F6D313016330404F710FC9A2FD067A2E3EF7B

the error is:

gpg: keyserver receive failed: Server indicated a failure
  • as I've explained in my answer and comment to the downvotes, it's related to DNS and the way that dirmngr in version 2.1.6 did reverse DNS that have been removed in version 2.1.8 I recall, but 2.2.x I've installed from Debian testing/unstable (Debian 9 current as at writing this) also fixed this issue. – Hvisage Feb 4 '18 at 15:52
47

Behind a firewall you should use the port 80 instead of the default port 11371 :

sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv 9A2FD067A2E3EF7B

Sample output:

Executing: /tmp/apt-key-gpghome.mTGQWBR2AG/gpg.1.sh --keyserver hkp://keyserver.ubuntu.com:80 --recv 9A2FD067A2E3EF7B
gpg: key 9A2FD067A2E3EF7B: "Launchpad PPA for GNS3" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1
| improve this answer | |
  • Not port 11371 or 80 related behind firewall. seems to be rather related to DNS resolution when you start to google the net... ``` Executing: /tmp/apt-key-gpghome.imkAGGXMO8/gpg.1.sh --receive-keys --debug-all -vvv --keyserver hkp://sks1.cryptokeys.org.za:80 gpg: DBG: chan_3 -> KEYSERVER --clear hkp://sks1.cryptokeys.org.za:80 gpg: DBG: chan_3 <- OK gpg: DBG: chan_3 -> KS_GET -- 0x9C1384B1168FD423 gpg: DBG: chan_3 <- ERR 167772379 Server indicated a failure <Dirmngr>``` – Hvisage Feb 1 '18 at 15:40
  • 12
    I get the same error using dirmngr 2.2.5, and adding hkp:// and :80 resolved the issue – lofidevops Apr 11 '18 at 15:25
6

This issue was really though for me, none of the proposed solutions worked for me until I found this post on reddit. I just went and added this line to /etc/resolv.conf

nameserver 8.8.8.8 # Google dns

you can try any other dns and see which one works for you.

| improve this answer | |
  • This doesn't seem to work unless the first nameserver in the list is functional. Most DNS activity will failover to the next resolver, but this wouldn't for some reason. – Andrew Bobulsky Oct 11 at 19:19
5

It has to do with DNS and what your DNS server does or does return for dirmngr ;( It got introduce since 2.1.16 with dirmngr, and I've been looking for solution myself on 2.1.6 with Debian's default packages. ;(

The correct answer, is: Upgrade to version 2.2.x or later that fixed this problem first time.

| improve this answer | |
  • @StephenKitt it wasn't a different answer, I gave the reason why it broke, as the other answer was a totally inadequate answer with all the wrong reasons why it was failing after I've investigated the 2.1.6 versions on Debian. There wasn't any real other fix than to get the latest version from a testing/unstable branch to get passed this problem, which was not HTTP/firewall related, but the DNS issue – Hvisage Feb 4 '18 at 15:50
  • Sorry, the comment above is a canned comment which wasn’t quite appropriate. Your edited answer does indeed answer the question, thanks. – Stephen Kitt Feb 4 '18 at 16:02
2

Encountered the same issue on ubuntu 18.04, running dirmngr 2.2.4. I went with the option of checking my dns settings and added my local dns server 'nameserver 1.1.1.1' and google's 'nameserver 8.8.8.8'. Then it worked.

| improve this answer | |
  • Specifying explicit DNS servers in my network config solved it for me. Gentoo, using NetworkManager. – Pistos Dec 28 '18 at 22:55
  • Also remember Quad9 (9.9.9.9) for helping to filter out malware/etc. in a privacy-advocacy manner ;) – Hvisage Dec 31 '18 at 10:14
  • Where add??? I just switched to dns 1.1.1.1 and am getting this issue – Trees4theForest Aug 20 '19 at 13:06
2

Add 0x before key, so that it turns 0xF88F6D313016330404F710FC9A2FD067A2E3EF7B.

This plus GAD3R's answer solved it for me.

| improve this answer | |
0

Usually when you have a non default DNS configuration in your system, for example if you're using dnsmasq or another DNS service, other than systemd-resolve, it's possible that dirmngr used by gpg fails to get the resolved name for keyserver.ubuntu.com, then, you need to check your name resolution software.

In my case, I have installed dnsmasq for name resolution in a Zimbra mail server. In this case it is important that you prevent that the resolvconf software controls dnsmasq, this is editing the /etc/default/dnsmasq file and uncommenting this line: IGNORE_RESOLVCONF=yes. Then you have to restart the dnsmasq and try to resolve with the local dns server with this command:

:~$ host -v keyserver.ubuntu.com 127.0.0.1

If it is ok, you will see something like this:

Trying "keyserver.ubuntu.com"
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases: 

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13994
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;keyserver.ubuntu.com.      IN  A

;; ANSWER SECTION:
keyserver.ubuntu.com.   417 IN  A   162.213.33.8
keyserver.ubuntu.com.   417 IN  A   162.213.33.9

Received 70 bytes from 127.0.0.1#53 in 14 ms
Trying "keyserver.ubuntu.com"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33907
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;keyserver.ubuntu.com.      IN  AAAA

Received 38 bytes from 127.0.0.1#53 in 1 ms
Trying "keyserver.ubuntu.com"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45211
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;keyserver.ubuntu.com.      IN  MX

;; AUTHORITY SECTION:
ubuntu.com.     1748    IN  SOA ns1.canonical.com. hostmaster.canonical.com. 2018053167 10800 3600 604800 3600

Received 99 bytes from 127.0.0.1#53 in 16 ms

Even if you're not using some DNS server, try to ask to systemd-resolve if it can resolve the URL with this:

:~$ host -v keyserver.ubuntu.com 127.0.0.53

If not, let us know what you get.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.