Why doesn't gpg-agent forwarding work?

[Kevin Gallagher]

Hi all,

I've tried to get this working to no avail. I've consulted past postings
to this list as well as various online references. Some people seem to
have got this to work, but most seem to have trouble. I would appreciate
any guidance or help anyone can offer.

I want my gpg-agent to be shared with another host, specifically a
Vagrant/VirtualBox virtual machine, via Unix socket forwarding, which is
a feature that arrived with OpenSSH 6.7. I can get my gpg-agent's socket
forwarded, and I can talk to it with gpg-connect-agent, and even obtain
a list of keygrips for the keys residing on the local machine. However,
the forwarded gpg-agent socket does not seem to interface with the GPG
CLI utility, i.e. running `gpg2 --use-agent --list-keys` shows nothing.

This is important because I'm in the process of developing a
deterministic build environment for a project, and many of us prefer to
use smartcards or YubiKeys, so copying our secret keys into the VM is
not an option. The ability to forward the local gpg-agent into the VM
for signing operations would be very convenient.

GPG version on host: 2.1.15 (Debian stretch)
GPG version on VM: 2.0.26 (Debian jessie)

This illustrates what I'm doing:

GPG_SOCK=$(echo "$GPG_AGENT_INFO" | cut -d: -f1)
vagrant ssh vm -- -t -A \
-R /home/vagrant/.gnupg/S.gpg-agent:$GPG_SOCK \
-o StreamLocalBindUnlink=yes \
-o ExitOnForwardFailure=yes

Setting some environment variables in the VM does not help:

GPG_AGENT_INFO=/home/vagrant/.gnupg/S.gpg-agent:0:1
GPG_SOCK=/home/vagrant/.gnupg/S.gpg-agent
GPG_TTY=/dev/pts/1

I've tried alternate/matching versions of GnuPG, pored over the manpages
and options, and tried other stuff, with no luck. Does anyone have any
idea why it is that gpg-connect-agent can speak to the forwarded socket
but not gpg? Has someone here got this working before?

thanks in advance,
Kevin




signature.asc
Description: OpenPGP digital signature
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Why doesn't gpg-agent forwarding work?

[Thomas Glanzmann]

Hello Kevin,

> GPG version on host: 2.1.15 (Debian stretch)
> GPG version on VM: 2.0.26 (Debian jessie)

gpg 2.0.26 does the gpg operations local and not using gnupg-agent.
Starting with the 2.1.x versions gnupg uses gnupg-agent for doing all
operations. As a result you need to have 2.1.x on the remote machine. On
the local you could have actually run 2.0 however your private key if
not stored on a smartcard would be exposed using the remote socket. Find
attached a build script do build gnupg 2.1.x for Debian jessie. Try not
to replace gnupg in the system because it would break to many things.
Instead install it to a separate location.

Build dependencies are:

sudo apt-get install texinfo transfig bison flex libbz2-dev libsqlite3-dev 
libgnutls28-dev pkg-config libusb-1.0-0-dev

Cheers,
Thomas


build.sh
Description: Bourne shell script
___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users