3

I have a Debian 10 server. I want to send email with msmtp and I need to cache a passphrase for a gpg key. The smtp password needed by msmtp is encrypted in a file using this gpg key. msmtp will use gpg to decrypt this file to get the smtp password.

This line is present in the /etc/msmtprc file :

passwordeval gpg --no-tty -q -d /etc/.msmtp-password.gpg

I'm trying to use gpg-agent and keychain to cache the password of the secret gpg key. This way the system could send emails without asking password.

I want that each time I boot the server I submit the passphrase for the gpg key only once, the passphrase for the key will be cached until the next reboot. (If I logout and login again I shouldn't need to submit the passphrase for the gpg key until the next reboot).

I didn't succeed because when I logout from the remote host (Debian server), the gpg-agent stop. If I'm establishing a new connection via SSH keychain start a new agent with a new PID and the passphrase for the key is lost.

Below you'll find what I did and I hope useful informations. I'll be happy if you could help me.

My linux version

cat /etc/issue
Debian GNU/Linux 10 \n \l

gpg version

gpg --version
gpg (GnuPG) 2.2.12
libgcrypt 1.8.4

We create a secret gpg key, a password for the key will be asked

gpg --gen-key
...
Nom réel : user@mdomain.tld
Adresse électronique : user@mdomain.tld
Vous avez sélectionné cette identité :
    « user@mdomain.tld <user@mdomain.tld> »
...
les clefs publique et secrète ont été créées et signées.

pub   rsa3072 2020-10-15 [SC] [expire : 2022-10-15]
      3C82AB1E9384F4A92CEBCE7077B1EDA25A942746
uid                      user@mdomain.tld <user@mdomain.tld>
sub   rsa3072 2020-10-15 [E] [expire : 2022-10-15]

We check the secret key

gpg --list-secret-keys --with-keygrip
...
sec   rsa3072 2020-10-15 [SC] [expire : 2022-10-15]
      3C82AB1E9384F4A92CEBCE7077B1EDA25A942746
      Keygrip = 47CF9E2C933761CF1021731F72603B8291BB211C
uid          [  ultime ] user@mdomain.tld <user@mdomain.tld>
ssb   rsa3072 2020-10-15 [E] [expire : 2022-10-15]
      Keygrip = 4133708B3FA225C4732A0F9FBD0053DEF937B46A

We look at the PID of the gpg-agent process

ps aux | grep gpg-agent
root       738 17.1  0.0  81204  3864 ?        SLs  16:55   0:04 /usr/bin/gpg-agent --supervised
root       745  0.0  0.0   6092   824 pts/0    S+   16:56   0:00 grep gpg-agent

We check the keys known by gpg-agent

gpg-connect-agent 'keyinfo --list' /bye
S KEYINFO 47CF9E2C933761CF1021731F72603B8291BB211C D - - - P - - -
S KEYINFO 4133708B3FA225C4732A0F9FBD0053DEF937B46A D - - - P - - -
OK

We check the gpg-agent options

gpgconf --list-options gpg-agent
Monitor:1:0:Options contrôlant la sortie de diagnostique:0:0::::
...
default-cache-ttl:24:0:oublier les codes personnels après N secondes:3:3:N:600::
default-cache-ttl-ssh:24:1:oublier les clefs SSH après N secondes:3:3:N:1800::
max-cache-ttl:24:2:définir la durée maximale du cache de code personnel à N secondes:3:3:N:7200::
max-cache-ttl-ssh:24:2:définir la durée maximale du cache de clef SSH à N secondes:3:3:N:7200::
...
pinentry-timeout:24:1:set the Pinentry timeout to N seconds:3:3:N:0::

default-cache-ttl and max-cache-ttl are too low, gpg-agent will cache the passphrase only 10 minutes. This is a too short period if you intend to use keychain. We can also add a log file. Default options can be changed by adding a gpg-agent.conf file.

cat ~/.gnupg/gpg-agent.conf
default-cache-ttl 31536000
max-cache-ttl 31536000
log-file /var/log/gpg-agent
debug-level basic

We check if new gpg-agent options have been added

gpgconf --list-options gpg-agent

Monitor:1:0:Options contrôlant la sortie de diagnostique:0:0::::
...
default-cache-ttl:24:0:oublier les codes personnels après N secondes:3:3:N:600::31536000
default-cache-ttl-ssh:24:1:oublier les clefs SSH après N secondes:3:3:N:1800::
max-cache-ttl:24:2:définir la durée maximale du cache de code personnel à N secondes:3:3:N:7200::31536000
max-cache-ttl-ssh:24:2:définir la durée maximale du cache de clef SSH à N secondes:3:3:N:7200::
...
pinentry-timeout:24:1:set the Pinentry timeout to N seconds:3:3:N:0::

We reload the gpg-agent configuration to activate the new options

gpg-connect-agent reloadagent /bye
OK

Know we install keychain

apt install -y keychain

keychain version

keychain -V

 * keychain 2.8.5 ~ http://www.funtoo.org

We cache decrypted GPG keys with keychain

keychain --eval --agents gpg 3C82AB1E9384F4A92CEBCE7077B1EDA25A942746

 * keychain 2.8.5 ~ http://www.funtoo.org
 * Inheriting gpg-agent (738)
GPG_AGENT_INFO=/run/user/0/gnupg/S.gpg-agent:738:1; export GPG_AGENT_INFO;

 * Adding 1 gpg key(s): 3C82AB1E9384F4A92CEBCE7077B1EDA25A942746

Because we entered the passphrase, the decrypted GPG key is now cached by gpg-agent (look at the 1)

gpg-connect-agent 'keyinfo --list' /bye
S KEYINFO 47CF9E2C933761CF1021731F72603B8291BB211C D - - 1 P - - -
S KEYINFO 4133708B3FA225C4732A0F9FBD0053DEF937B46A D - - - P - - -
OK

We modify the .bashrc file. On next login keychain will find the decrypted GPG key cached by gpg-agent. On next reboot keychain will ask once the passphrase for the key until the next reboot

cat ~/.bashrc
...
# Note: PS1 and umask are already set in /etc/profile. You should not
# need this unless you want different defaults for root.
# PS1='${debian_chroot:+($debian_chroot)}\h:\w\$ '
# umask 022
...
eval $(keychain --agents gpg)

In order to check default-cache-ttl and max-cache-ttl we wait 700 seconds, more than gpg-agent default configuration

jeudi 15 octobre 2020, 16:56:32 (UTC+0200)

jeudi 15 octobre 2020, 17:08:12 (UTC+0200)

We check the keys known by gpg-agent the decrypted GPG key is still cached by gpg-agent (look at the 1)

gpg-connect-agent 'keyinfo --list' /bye
S KEYINFO 47CF9E2C933761CF1021731F72603B8291BB211C D - - 1 P - - -
S KEYINFO 4133708B3FA225C4732A0F9FBD0053DEF937B46A D - - - P - - -
OK

We create a file and encrypt it with the key (no passphrase is needed for encryption)

touch file.txt && gpg -e -r user@mdomain.tld file.txt

We decrypt the file. No passphrase is needed because the decrypted GPG key is still cached by gpg-agent after 700 seconds

gpg --decrypt file.txt.gpg > file.txt
gpg: chiffré avec une clef RSA de 3072 bits, identifiant 4E40A1918B514393, créée le 2020-10-15
      « user@mdomain.tld <user@mdomain.tld> »

We logout and login again to the remote host via ssh. At new login keychain can't find the previous gpg-agent with the cached key. Then keychain start a new gpg-agent but the cached key is lost...

* keychain 2.8.5 ~ http://www.funtoo.org
* Starting gpg-agent...

Regards

1 Answer 1

4

Eventually I found a solution.

gpg-agent is closed after logout from bash session because it is in supervised mode.

Look at the file :

/usr/share/doc/gpg-agent/README.Debian

systemd =======

Since 2.1.17, users on machines with systemd will have their gpg-agent process launched automatically by systemd's user session, upon first access of any of the expected gpg-agent sockets (including the ssh socket). systemd will also cleanly tear this process down at session logout.

So wee need to start gpg-agent in daemon mode to keep the same PID for gpg-agent across the sessions.

Before we do this we need to "mask" gpg-agent from systemd

systemctl --user mask --now gpg-agent.service gpg-agent.socket gpg-agent-ssh.socket gpg-agent-extra.socket gpg-agent-browser.socket

This can be undone with "unmask" option (see the README.Debian file).

The next time gpg-agent will be requested (eg when creating a secret key or using keychain) it will start in daemon mode and live across the sessions.

ps aux | grep gpg-agent
root       816  0.2  0.0  81356  3624 ?        Ss   17:19   0:04 gpg-agent
--homedir /root/.gnupg --use-standard-socket --daemon

And in the .bashrc file just add :

eval $(keychain --eval --agents gpg secretkey)

After logout if you login again keychain find the right gpg-agent (look at the PID), no passphrase have been asked.

keychain 2.8.5 ~ http://www.funtoo.org
Found existing gpg-agent: 816
Known gpg key: 677AAEB080C1045F3D3D3532B5AE92F1F49350D1

and you can still decrypt file without passphrase

gpg --decrypt file.txt.gpg > file.txt
gpg: chiffré avec une clef RSA de 3072 bits, identifiant F1B9BB72AAECF1C7,
créée le 2020-10-16
« user@domain.tld <user@domain.tld> »

Hope this help.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.