I have recently tried migrating from a standard ssh public key setup to managing my keys with GPG. Following instructions on my distribution's wiki, I set up ssh to use gpg-agent
instead of the default ssh-agent
. I am quite certain that went fine: even with my ~/.ssh
directory removed, ssh-add -l
shows the one key I set up for it in gpg.
After that, I set the contents of my remote's ~/.ssh/authorized_keys
to exactly the output of local ssh-add -L
and restarted the daemon.
Now trying to connect to my remote using ssh -v <myremote>
, I get the following error:
...
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering public key: (none) RSA SHA256:<myfingerprint> agent
debug1: Server accepts key: (none) RSA SHA256:<myfingerprint> agent
sign_and_send_pubkey: signing failed: agent refused operation
debug1: Trying private key: /home/zoickx/.ssh/id_rsa
debug1: Trying private key: /home/zoickx/.ssh/id_dsa
debug1: Trying private key: /home/zoickx/.ssh/id_ecdsa
debug1: Trying private key: /home/zoickx/.ssh/id_ed25519
debug1: Trying private key: /home/zoickx/.ssh/id_xmss
debug1: No more authentication methods to try.
<myremote>: Permission denied (publickey).
Clearly, server agrees that my public key is authorized, but, for a reason that's unclear to me, refuses to continue.
The common answers if googling "sign_and_send_pubkey: signing failed
" are to use ssh-add
to add the missing private key or to change the permissions on keyfiles. Neither of these seem to be helpful in my case, using gpg-agent. My key does seem to be available to ssh, and there are no files to change permissions of.
A couple of things I am worried about:
- I do not get prompted for gpg's pinentry at any point
- The public key has the form
ssh-rsa <key> (none)
, ending with the strange "none" instead of the standarduser@host
.
Additional information about my setup:
- gpg 2.2.15
- libgcrypt 1.8.4
- Output of
gpgconf
:
gpg:OpenPGP:/usr/bin/gpg
gpg-agent:Private Keys:/usr/bin/gpg-agent
scdaemon:Smartcards:/usr/lib/gnupg/scdaemon
gpgsm:S/MIME:/usr/bin/gpgsm
dirmngr:Network:/usr/bin/dirmngr
pinentry:Passphrase Entry:/usr/bin/pinentry
- gpg functions as expected for encryption/decryption, with pinentry working
- Not running Gnome or any other desktop environment - using dwm
- seahorse is installed
gpg --version
... and is there a pinentry program listed in gpg config ...gpgconf
... and does gpg function as expected with encryption and decryption processes other than integration with ssh-agent ... lastly, are you running Gnome along with its password managerseahorse
or some other desktop?