On Fri, 22 Oct 2010 03:58, aaron.topo...@gmail.com said:
> First, there is _ZERO_ documentation for this binary. No manual, no info
> page, nothing under /usr/share/doc/, segfaults pasing "-h" or "--help".
Ah well, it should be removed from the package. It used to be a kind of
debug tool but I never used it in all these years. The plan was to
replace it with a special export option:
gpg2 --export-options export-sexp-format --export-secret-key KEYID
but that has never been fully implemented. The forthcoming GnuPG 2.1
makes it obsolete.
> of me. Correct me if I'm wrong, but I should be able to add this
> identity to the running SSH agent through "ssh-add", no? Here's the
No. It the other way around.
The whole point of the ssh support is to replace ssh-agent: gpg-agent if
started with the option --enable-ssh-support implements the
ssh-agent-protocol and thus works with ssh and ssh-add.
With a running gpg-agent you can do
ssh-add
and gpg-agent imports the key into its own private key database. After
you have done that you may remove the private keys from .ssh/. IF you
later run
ssh-add -l
it will show you the ssh keys gpg-agent knows about. To better control
this you may use the ~/.gnupg/sshcontrol file:
`sshcontrol'
This file is used when support for the secure shell agent protocol
has been enabled (*note option --enable-ssh-support::). Only keys
present in this file are used in the SSH protocol. You should
backup this file.
The `ssh-add' tool may be used to add new entries to this file;
you may also add them manually. Comment lines, indicated by a
leading hash mark, as well as empty lines are ignored. An entry
starts with optional whitespace, followed by the keygrip of the
key given as 40 hex digits, optionally followed by the caching TTL
in seconds and another optional field for arbitrary flags. A
non-zero TTL overrides the global default as set by
`--default-cache-ttl-ssh'.
The keygrip may be prefixed with a `!' to disable an entry entry.
The following example lists exactly one key. Note that keys
available through a OpenPGP smartcard in the active smartcard
reader are implicitly added to this list; i.e. there is no need to
list them.
# Key added on 2005-02-25 15:08:29
5A6592BF45DC73BD876874A28FD4639282E29B52 0
If you want to use an existing gpg key with ssh you need a way to put it
into gpg-agent. If you use smartcards then there is no need for this
because gpg-agent does that of its own. *GnuPG 2.1* will make it really
easy to use an existing key for ssh:
$ gpg2 --with-keygrip -K CD8687F6
sec 1024D/CD8687F6 2006-01-17
Keygrip = 21EB68B1FFA01EF777E2D0B1A92A2276D82C2F1C
uid Heinrich Heine <heinri...@duesseldorf.de>
ssb 1024g/4ECFEF6F 2006-01-17
Keygrip = 654EFA6F19DF08ABFEB88092BC4867D4C5A95460
Now you only need to put a line
21EB68B1FFA01EF777E2D0B1A92A2276D82C2F1C 0
into sshcontrol and gpg-agent offers the primary key CD8687F6 to ssh if
it asks for a list private key (check with ssh-add -l).
Salam-Shalom,
Werner
--
Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz.
_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users
