0

I am trying to set up passbolt on a Debian 9 KVM guest, and one of the steps is to generate a GPG key as the www-data user. Unfortunately, whenever I try to do this (by running gpg --gen-key as the www-data user), I get the following output:

...
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
gpg: agent_genkey failed: Permission denied
Key generation failed: Permission denied

The home directory for the www-data user is /var/www and the user has read-write permission there. If I run gpg --list-keys (as the www-data user) beforehand, it successfully creates the /var/www/.gnupg directory, so its not like the user doesn't have the correct permissions there.

What do I need to do in order to generate a GPG key as the www-data user?

Appendix

The env output if I log into www-data using sudo su www-data:

LS_COLORS=rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.Z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.m4a=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.oga=00;36:*.opus=00;36:*.spx=00;36:*.xspf=00;36:
LANG=en_US.UTF-8
SUDO_GID=1000
USERNAME=root
SUDO_COMMAND=/bin/su www-data
USER=www-data
PWD=/home/stuart
HOME=/var/www
SUDO_USER=stuart
SUDO_UID=1000
MAIL=/var/mail/www-data
SHELL=/bin/bash
TERM=xterm-256color
SHLVL=1
LOGNAME=www-data
PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
_=/usr/bin/env

The env output if I log in using sudo su - www-data

LANG=en_US.UTF-8
USER=www-data
PWD=/var/www
HOME=/var/www
MAIL=/var/mail/www-data
SHELL=/bin/bash
TERM=xterm-256color
SHLVL=1
LOGNAME=www-data
PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
_=/usr/bin/env

The env output if I log in using ssh www-data@mydomain.com

SSH_CONNECTION=192.168.16.155 50692 192.168.16.152 22
LANG=en_US.UTF-8
XDG_SESSION_ID=11
USER=www-data
PWD=/var/www
HOME=/var/www
SSH_CLIENT=192.168.16.155 50692 22
SSH_TTY=/dev/pts/0
MAIL=/var/mail/www-data
TERM=xterm-256color
SHELL=/bin/bash
SHLVL=1
LOGNAME=www-data
XDG_RUNTIME_DIR=/run/user/33
PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
_=/usr/bin/env
  • what is the exact command that you are running ? – Pierre-Alain TORET Oct 24 '18 at 12:30
  • @Pierre-AlainTORET gpg --gen-key, it asks for name, then email address, then confirmation for okay, then fails at the point where the gpg-agent would notrmall ask for a passphrase to encrypt the key with, that prompt never appears – Programster Oct 24 '18 at 12:38
  • Ok, but I mean do you use sudo ? or su ? or how do you become www-data to execute that command. Can you add the details to the post please ? – Pierre-Alain TORET Oct 24 '18 at 12:41
  • I don't use sudo, I literally use gpg --gen-key. I became the www-data user by changing /etc/passwd so that www-data uses /bin/bash instead of nologin and then doing sudo su www-data, but the same situation applies when I created another user to test with who is also a non-sudo user. (created user using sudo adduser testuser) – Programster Oct 24 '18 at 12:44
0

It appears that you cannot generate keys if you logged into a user account using sudo su [user]. However, if you SSH into the server as that user, e.g. ssh www-data@mydomain.com, then gpg --gen-key will work.

  • did you try with sudo su - user ? – Pierre-Alain TORET Oct 24 '18 at 13:02
  • I just tried that, and that didn't work either. – Programster Oct 24 '18 at 13:04
  • do you mind running env after having connected by ssh and by running sudo ? – Pierre-Alain TORET Oct 24 '18 at 13:05
  • Looks like : stackoverflow.com/questions/28802525/… – Pierre-Alain TORET Oct 24 '18 at 13:08
  • I can see how you think its similar, but it looks like he is having a different issue with the error being: gpg: problem with the agent: Timeout whereas for me its a permission denied issue. – Programster Oct 24 '18 at 13:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.