I have recently tried migrating from a standard ssh public key setup to managing my keys with GPG. Following instructions on my distribution's wiki, I set up ssh to use gpg-agent instead of the default ssh-agent. I am quite certain that went fine: even with my ~/.ssh directory removed, ssh-add -l shows the one key I set up for it in gpg.

After that, I set the contents of my remote's ~/.ssh/authorized_keys to exactly the output of local ssh-add -L and restarted the daemon.

Now trying to connect to my remote using ssh -v <myremote>, I get the following error:

debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering public key: (none) RSA SHA256:<myfingerprint> agent
debug1: Server accepts key: (none) RSA SHA256:<myfingerprint> agent
sign_and_send_pubkey: signing failed: agent refused operation
debug1: Trying private key: /home/zoickx/.ssh/id_rsa
debug1: Trying private key: /home/zoickx/.ssh/id_dsa
debug1: Trying private key: /home/zoickx/.ssh/id_ecdsa
debug1: Trying private key: /home/zoickx/.ssh/id_ed25519
debug1: Trying private key: /home/zoickx/.ssh/id_xmss
debug1: No more authentication methods to try.
<myremote>: Permission denied (publickey).

Clearly, server agrees that my public key is authorized, but, for a reason that's unclear to me, refuses to continue.

The common answers if googling "sign_and_send_pubkey: signing failed" are to use ssh-add to add the missing private key or to change the permissions on keyfiles. Neither of these seem to be helpful in my case, using gpg-agent. My key does seem to be available to ssh, and there are no files to change permissions of.

A couple of things I am worried about:

  • I do not get prompted for gpg's pinentry at any point
  • The public key has the form ssh-rsa <key> (none), ending with the strange "none" instead of the standard user@host.

Additional information about my setup:

  • gpg 2.2.15
  • libgcrypt 1.8.4
  • Output of gpgconf:
gpg-agent:Private Keys:/usr/bin/gpg-agent
pinentry:Passphrase Entry:/usr/bin/pinentry
  • gpg functions as expected for encryption/decryption, with pinentry working
  • Not running Gnome or any other desktop environment - using dwm
  • seahorse is installed
  • Which version of gpg ... gpg --version ... and is there a pinentry program listed in gpg config ... gpgconf ... and does gpg function as expected with encryption and decryption processes other than integration with ssh-agent ... lastly, are you running Gnome along with its password manager seahorse or some other desktop? – RubberStamp May 26 at 23:43
  • @RubberStamp , edited my post with the answers – zoickx May 27 at 14:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.