I have recently tried migrating from a standard ssh public key setup to managing my keys with GPG. Following instructions on my distribution's wiki, I set up ssh to use
gpg-agent instead of the default
ssh-agent. I am quite certain that went fine: even with my
~/.ssh directory removed,
ssh-add -l shows the one key I set up for it in gpg.
After that, I set the contents of my remote's
~/.ssh/authorized_keys to exactly the output of local
ssh-add -L and restarted the daemon.
Now trying to connect to my remote using
ssh -v <myremote>, I get the following error:
... debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey debug1: Next authentication method: publickey debug1: Offering public key: (none) RSA SHA256:<myfingerprint> agent debug1: Server accepts key: (none) RSA SHA256:<myfingerprint> agent sign_and_send_pubkey: signing failed: agent refused operation debug1: Trying private key: /home/zoickx/.ssh/id_rsa debug1: Trying private key: /home/zoickx/.ssh/id_dsa debug1: Trying private key: /home/zoickx/.ssh/id_ecdsa debug1: Trying private key: /home/zoickx/.ssh/id_ed25519 debug1: Trying private key: /home/zoickx/.ssh/id_xmss debug1: No more authentication methods to try. <myremote>: Permission denied (publickey).
Clearly, server agrees that my public key is authorized, but, for a reason that's unclear to me, refuses to continue.
The common answers if googling "
sign_and_send_pubkey: signing failed" are to use
ssh-add to add the missing private key or to change the permissions on keyfiles. Neither of these seem to be helpful in my case, using gpg-agent. My key does seem to be available to ssh, and there are no files to change permissions of.
A couple of things I am worried about:
- I do not get prompted for gpg's pinentry at any point
- The public key has the form
ssh-rsa <key> (none), ending with the strange "none" instead of the standard
Additional information about my setup:
- gpg 2.2.15
- libgcrypt 1.8.4
- Output of
gpg:OpenPGP:/usr/bin/gpg gpg-agent:Private Keys:/usr/bin/gpg-agent scdaemon:Smartcards:/usr/lib/gnupg/scdaemon gpgsm:S/MIME:/usr/bin/gpgsm dirmngr:Network:/usr/bin/dirmngr pinentry:Passphrase Entry:/usr/bin/pinentry
- gpg functions as expected for encryption/decryption, with pinentry working
- Not running Gnome or any other desktop environment - using dwm
- seahorse is installed