3

I am trying to edit an encrypted file remotely, with no X-forwarding.

Locally, when I launch:

emacs myfile.gpg

A pop-up window opens in which I enter my passphrase. I'd like to have something similar in "command line only", with no window opening; when I do that through SSH with no X forwarding, it gets stuck (all I have is a blank emacs in which I cannot do anything).

I took an example where I am trying to edit a file, but I encounter the same problem with any action requiring my passphrase like

gpg --decrypt myfile.gpg --output myfile.txt
2
  • 1
    The gpg-agent running your local system is not accessible in the remote ssh connection. Are the pgp keys needed for file decryption stored on the remote system (probably not advisable) or the local system (most likely)? Commented Nov 19, 2018 at 17:12
  • The pgp keys are on the system that I access.
    – MBR
    Commented Nov 20, 2018 at 9:59

2 Answers 2

4

You can change the pinentry mode:

gpg -d --pinentry-mode loopback my_file.gpg -o myfile.txt

Now it should ask for the passphrase via command-line.

More details on How to force GPG to use console-mode pinentry to prompt for passwords?.

2
  • Thanks, it partially answers my question; I can now indeed enter the passphrase via the command-line and see the content of the file.
    – MBR
    Commented Nov 20, 2018 at 10:03
  • Warning to those who test this out, and on decryption find that GPG shows you the contents without asking for the passphrase! It caches symmetric passphrases unless you also add the --no-symkey-cache option. Commented Jun 16, 2021 at 0:56
1

Thanks to francescop21's answer, I found how to configure globally the pinentry mode (for GnuPG version 2.1+): I simply had to create (or edit) .gnupg/gpg.conf file in which I added the following line:

pinentry-mode loopback

Now I can seamlessly open my file with emacs (or any other application). But I am still stuck with GnuPG version lesser than 2.1.

7
  • With gpg 1.x you don't need to change pinentry mode as it should always ask for passphrase via command-line. Commented Nov 20, 2018 at 13:28
  • I have the problem with gpg 2.0; pinentry-mode is not recognize (neither as a command-line argument nor as an entry in the configuration file). I can find the argument in gpg 2.1+ manpage but not in gpg 2.0.
    – MBR
    Commented Nov 20, 2018 at 15:25
  • For gpg 2.0, I found the command-line option --passphrase-fd 0 that allows me to interact with a file with no graphical interface, but it does not work if I put it in my .gnupg/gpg.conf file.
    – MBR
    Commented Nov 21, 2018 at 8:37
  • I tried to set up my gpg-agent setting pinentry-program /usr/bin/pinentry-curses in .gnupg/gpg-agent.conf, but it did not work either. As for my test with passphrase-fd in .gnupg/gpg.conf, when I try to open my file with emacs it gets stuck and all I can do I close my current terminal.
    – MBR
    Commented Nov 21, 2018 at 10:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .