1

How to set gpg-agent --no-allow-external-cache --default-cache-ttl 10 --max-cache-ttl 20 in a shell script? After I issue the command, it gives gpg-agent[4869]: gpg-agent running and available but the cache ttl values are not changed. I verified it by gpgconf --list-options gpg-agent | grep cache as well as actually do a --decrypt and the key is still cached after 30 seconds.

I know that web resources suggest changing these configurations in the file ~/.gnupg/gpg-agent.conf. I am not sure why I do not have that file. Even I am root, I cannot open vi /root/S.gpg-agent file. Anyway, I do not prefer changing these settings in the configuration file. I prefer to have different Cache TTL for different --decrypt. So It has to be issued from the shell script.

# ls -al /root/.gnupg/
total 36
drwx------  3 root root 4096 Jun  2 05:51 .
drwx------ 14 root root 4096 Jun  2 14:18 ..
-rw-r--r--  1 root root   24 Jun  2 03:28 .#lk0x00005558d8861f30.gentoo_bazic.26472
-rw-r--r--  1 root root   24 Jun  2 04:16 .#lk0x0000556c15e3ef30.gentoo_bazic.7432
-rw-r--r--  1 root root   24 Jun  1 20:45 .#lk0x00005576e9d54f30.gentoo_bazic.29752
drwx------  2 root root 4096 Jun  1 02:43 private-keys-v1.d
-rw-------  1 root root   32 Jun  1 02:43 pubring.kbx
-rw-------  1 root root  600 Jun  2 05:20 random_seed
srwx------  1 root root    0 Jun  2 05:51 S.gpg-agent
srwx------  1 root root    0 Jun  2 05:51 S.gpg-agent.browser
srwx------  1 root root    0 Jun  2 05:51 S.gpg-agent.extra
srwx------  1 root root    0 Jun  2 05:51 S.gpg-agent.ssh
-rw-------  1 root root 1200 Jun  2 03:19 trustdb.gpg

P.S. I know that it is possible to clear the cache by echo RELOADAGENT | gpg-connect-agent. But this is less desirable.

Reference

https://www.gnupg.org/documentation/manuals/gnupg/Agent-Options.html

https://www.gnu.org/software/emacs/manual/html_node/pgg/Caching-passphrase.html

1 Answer 1

1

agent start parameters

gpg-agent[4869]: gpg-agent running and available

I assume that the agent exited right away after starting, the process 4869 had a lifespan of ~1 second. Your test gpgconf --list-options gpg-agent did probably connect to the agent that was already running with its default configuration.

gpg-agent in general doesn't seem to be designed to change its configuration while running, at least not without clearing the cache (which is not an option).

configuration file

You don't have the file ~/.gnupg/gpg-agent.conf because it doesn't get created by default.

The vi /root/S.gpg-agent was probably a typo, meant to be vi /root/.gnupg/S.gpg-agent. You can't edit S.gpg-agent because it's a socket, not a regular file.

manage multiple configuration files

You don't want to change these settings in the configuration file, because you want different configurations per --decrypt. Depending on the amount of keys or complexity of use cases, it might be an alternative for you to use different GPG home directories.

If you manage /root/gnupg-home-1/ and /root/gnupg-home-2/, each directory can have its own gpg-agent.conf in it, each with different cache TTL values. The commands

  • gpg --homedir /root/gnupg-home-1/ --decrypt ...
  • gpg --homedir /root/gnupg-home-2/ --decrypt ...

would trigger the start of different agent instances, each with their own configuration.

test/verification

You can verify the result (like you did before) with gpgconf, you just need to add the --homedir parameter:

  • gpgconf --homedir /root/gnupg-home-1/ --list-options gpg-agent |grep cache
  • gpgconf --homedir /root/gnupg-home-2/ --list-options gpg-agent |grep cache

access limitation

If root's umask doesn't prevent access to group and others already, these directories should be created with mkdir --mode=700 <directoryname>.

cleanup

Is it necessary to kill the agents after using?

From a security perspective this shouldn't be necessary, if the caching is implemented properly and the configured TTL is rather short.

From a system maintenance perspective, on a server with potentially high uptime it's a good idea to kill the agent processes, when they are not needed anymore. Otherwise the amount of unused agent processes might increase too much.

From a software state perspective, it would be inconsistent to delete the directory and keep the agent process. In my tests (gpg-agent version 2.2.35) the agent process disappeared automatically after deleting the directory. But i couldn't find anything about this in the man page, so i don't know why this happened and how reliable this is.

Depending on the use case and how your script is implemented, there might be a risk of unintended reuse of an old configuration, if the agent process is still alive after the directory has been deleted. Such a bug can be avoided by using unique directory names (eg. by using uuidgen).

2
  • Nice. It works perfectly. Adding mkdir -m 700 ~/gnupg-home-1 would make it more complete. So, having a configuration file ~/gnupg-home-1/gpg-agent.conf is the only way. We cannot pass the options to gpg-agent. After creating two more agents, may I ask how should I clean up after use? Do I need to "kill" the extra agents? Or just rm -r the gnupg-home directories? Thank you.
    – midnite
    Jun 2, 2022 at 12:46
  • @midnite i added more information, mostly about cleanup.
    – Sheldon
    Jun 2, 2022 at 15:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .