4

I'd like to set the password cache in gpg-agent to 15 seconds. Here is what I have done:

My two configuration files and their contents:

/home/xixor/.gnupg/gpg.conf - telling gpg to use gpg-agent:

use-agent

/home/xixor/.gnupg/gpg-agent.conf - telling gpg-agent to cache password to unlock gpg key 15 seconds and use pinentry program for inputting password:

default-cache-ttl 15
max-cache-ttl 15
pinentry-program /usr/bin/pinentry

Reload gpg-agent and confirm via logs it is reading from gpg-agent.conf:

echo RELOADAGENT | gpg-connect-agent
OK
Aug 08 20:35:23 opticon gpg-agent[35328]: SIGHUP received - re-reading configuration and flushing cache
Aug 08 20:35:23 opticon gpg-agent[35328]: reading options from '/home/xixor/.gnupg/gpg-agent.conf'

Double-check to confirm correct 15 second configurations are loaded at this point:

gpgconf --list-options gpg-agent | awk -F: '$1=="default-cache-ttl" {print $10}'
15
gpgconf --list-options gpg-agent | awk -F: '$1=="max-cache-ttl" {print $10}'
15

At this point, I can call a program that needs to unlock my gpg key, and as expected it prompts for a password using pinentry to unlock the key.

THEN, I wait at least 15 seconds to run the same command again and expect it to ask for password using pinentry again (because the 15 second cache should have expired) but there is no password prompt, meaning it is not respecting the cache settings in gpg-agent.conf. It seems to revert to its default 600 second cache.

I do NOT have any other keychain program (like gnome-keychain/seahorse/kwallet) installed that could be competing for access to gpg.

What am I missing here?

1 Answer 1

3

After many hours of searching, I found that the gpg-agent cache settings in gpg-agent.conf are ignored if/when one is using a smartcard to store their gpg keys.

In my case, I have my gpg keys stored on a yubikey, the yubikey is unlocked using a PIN code, and the PIN code cache settings are controlled by pcscd daemon, which overrides gpg-agent.conf settings.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .