2

I have recently tried migrating from a standard ssh public key setup to managing my keys with GPG. Following instructions on my distribution's wiki, I set up ssh to use gpg-agent instead of the default ssh-agent. I am quite certain that went fine: even with my ~/.ssh directory removed, ssh-add -l shows the one key I set up for it in gpg.

After that, I set the contents of my remote's ~/.ssh/authorized_keys to exactly the output of local ssh-add -L and restarted the daemon.

Now trying to connect to my remote using ssh -v <myremote>, I get the following error:

...
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering public key: (none) RSA SHA256:<myfingerprint> agent
debug1: Server accepts key: (none) RSA SHA256:<myfingerprint> agent
sign_and_send_pubkey: signing failed: agent refused operation
debug1: Trying private key: /home/zoickx/.ssh/id_rsa
debug1: Trying private key: /home/zoickx/.ssh/id_dsa
debug1: Trying private key: /home/zoickx/.ssh/id_ecdsa
debug1: Trying private key: /home/zoickx/.ssh/id_ed25519
debug1: Trying private key: /home/zoickx/.ssh/id_xmss
debug1: No more authentication methods to try.
<myremote>: Permission denied (publickey).

Clearly, server agrees that my public key is authorized, but, for a reason that's unclear to me, refuses to continue.

The common answers if googling "sign_and_send_pubkey: signing failed" are to use ssh-add to add the missing private key or to change the permissions on keyfiles. Neither of these seem to be helpful in my case, using gpg-agent. My key does seem to be available to ssh, and there are no files to change permissions of.

A couple of things I am worried about:

  • I do not get prompted for gpg's pinentry at any point
  • The public key has the form ssh-rsa <key> (none), ending with the strange "none" instead of the standard user@host.

Additional information about my setup:

  • gpg 2.2.15
  • libgcrypt 1.8.4
  • Output of gpgconf:
gpg:OpenPGP:/usr/bin/gpg
gpg-agent:Private Keys:/usr/bin/gpg-agent
scdaemon:Smartcards:/usr/lib/gnupg/scdaemon
gpgsm:S/MIME:/usr/bin/gpgsm
dirmngr:Network:/usr/bin/dirmngr
pinentry:Passphrase Entry:/usr/bin/pinentry
  • gpg functions as expected for encryption/decryption, with pinentry working
  • Not running Gnome or any other desktop environment - using dwm
  • seahorse is installed
  • Which version of gpg ... gpg --version ... and is there a pinentry program listed in gpg config ... gpgconf ... and does gpg function as expected with encryption and decryption processes other than integration with ssh-agent ... lastly, are you running Gnome along with its password manager seahorse or some other desktop? – RubberStamp May 26 at 23:43
  • @RubberStamp , edited my post with the answers – zoickx May 27 at 14:34
1

Since you're not being prompted to enter your GPG passphrase, the problem may be that the running gpg-agent cannot access the display/terminal. I encountered the same symptoms on Mac OS 10.14 (Mojave) with GPG version 2.2.17.

I found a workaround in the man page for gpg-agent:

Note: in case the gpg-agent receives a signature request, the user might need to be prompted for a passphrase, which is necessary for decrypting the stored key. Since the ssh-agent protocol does not contain a mechanism for telling the agent on which display/terminal it is running, gpg-agent's ssh-support will use the TTY or X display where gpg-agent has been started. To switch this display to the current one, the following command may be used:

     gpg-connect-agent updatestartuptty /bye

While I have not found a permanent solution, this command works for me. It needs to be repeated after each restart.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.