4

I have recently tried migrating from a standard ssh public key setup to managing my keys with GPG. Following instructions on my distribution's wiki, I set up ssh to use gpg-agent instead of the default ssh-agent. I am quite certain that went fine: even with my ~/.ssh directory removed, ssh-add -l shows the one key I set up for it in gpg.

After that, I set the contents of my remote's ~/.ssh/authorized_keys to exactly the output of local ssh-add -L and restarted the daemon.

Now trying to connect to my remote using ssh -v <myremote>, I get the following error:

...
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering public key: (none) RSA SHA256:<myfingerprint> agent
debug1: Server accepts key: (none) RSA SHA256:<myfingerprint> agent
sign_and_send_pubkey: signing failed: agent refused operation
debug1: Trying private key: /home/zoickx/.ssh/id_rsa
debug1: Trying private key: /home/zoickx/.ssh/id_dsa
debug1: Trying private key: /home/zoickx/.ssh/id_ecdsa
debug1: Trying private key: /home/zoickx/.ssh/id_ed25519
debug1: Trying private key: /home/zoickx/.ssh/id_xmss
debug1: No more authentication methods to try.
<myremote>: Permission denied (publickey).

Clearly, server agrees that my public key is authorized, but, for a reason that's unclear to me, refuses to continue.

The common answers if googling "sign_and_send_pubkey: signing failed" are to use ssh-add to add the missing private key or to change the permissions on keyfiles. Neither of these seem to be helpful in my case, using gpg-agent. My key does seem to be available to ssh, and there are no files to change permissions of.

A couple of things I am worried about:

  • I do not get prompted for gpg's pinentry at any point
  • The public key has the form ssh-rsa <key> (none), ending with the strange "none" instead of the standard user@host.

Additional information about my setup:

  • gpg 2.2.15
  • libgcrypt 1.8.4
  • Output of gpgconf:
gpg:OpenPGP:/usr/bin/gpg
gpg-agent:Private Keys:/usr/bin/gpg-agent
scdaemon:Smartcards:/usr/lib/gnupg/scdaemon
gpgsm:S/MIME:/usr/bin/gpgsm
dirmngr:Network:/usr/bin/dirmngr
pinentry:Passphrase Entry:/usr/bin/pinentry
  • gpg functions as expected for encryption/decryption, with pinentry working
  • Not running Gnome or any other desktop environment - using dwm
  • seahorse is installed
2
  • Which version of gpg ... gpg --version ... and is there a pinentry program listed in gpg config ... gpgconf ... and does gpg function as expected with encryption and decryption processes other than integration with ssh-agent ... lastly, are you running Gnome along with its password manager seahorse or some other desktop? May 26, 2019 at 23:43
  • @RubberStamp , edited my post with the answers
    – zoickx
    May 27, 2019 at 14:34

1 Answer 1

3

Since you're not being prompted to enter your GPG passphrase, the problem may be that the running gpg-agent cannot access the display/terminal. I encountered the same symptoms on Mac OS 10.14 (Mojave) with GPG version 2.2.17.

I found a workaround in the man page for gpg-agent:

Note: in case the gpg-agent receives a signature request, the user might need to be prompted for a passphrase, which is necessary for decrypting the stored key. Since the ssh-agent protocol does not contain a mechanism for telling the agent on which display/terminal it is running, gpg-agent's ssh-support will use the TTY or X display where gpg-agent has been started. To switch this display to the current one, the following command may be used:

     gpg-connect-agent updatestartuptty /bye

While I have not found a permanent solution, this command works for me. It needs to be repeated after each restart.

1
  • Thanks for the great answer. I've been being stuck on the same issue.
    – flyingice
    Mar 15, 2022 at 2:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .