blob: 96ab7cb6ed9f1f39bd5e94cddf3100f06d94ce81 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
|
<!--
title: GnuPG for SSH Authentication
Description: Using gpg-agent as an alternative to ssh-agent
author: ahriman
-->
# Using GPG for SSH Authentication
It's a fairly simply process to have gpg-agent handle your SSH
authentication. To start off, you'll need to have a private GnuPG key
generated with an appropriate subkey for authentication. Once that's
taken care of, open up `~/.gnupg/gpg-agent.conf`
```
$ cat ~/.gnupg/gpg-agent.conf
enable-ssh-support
default-cache-ttl 60
max-cache-ttl 120
```
Now you'll need to append the following to `~/.bashrc`, or the appropriate
rc file for your shell
```
$ cat ~/.bashrc
export GPG_TTY="$(tty)"
export SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket)
gpg-connect-agent updatestartuptty /bye > /dev/null
```
Once that's done, you'll need to let `gpg-agent` know which GnuPG subkey
to use for SSH authentication. Run the following and copy the keygrip
associated with the subkey you've generated specifically for authentication.
Don't use *my* keygrip, however. The output here is just for an example. `GnuPG`
computes the keygrips from the public key, so nothing here is sensitive
or private.
```
$ gpg --with-keygrip -k ben@gbmor.dev
pub rsa4096/0xEAB272409CD12FF0 2018-11-25 [SC]
Key fingerprint = 291A AFF7 A291 7DAB 0E01 6B9C EAB2 7240 9CD1 2FF0
Keygrip = DE06FAA273017BBD8778F94639611CEF53AB9EBC
uid [ultimate] Ben Morrison <ben@gbmor.dev>
sub rsa4096/0xF9C3B650612249D9 2018-11-25 [E]
Keygrip = 751ADAC109736316B6ABEBB3F2BDF4612F8A630C
sub rsa4096/0x4969E5731CFEB507 2018-11-25 [A]
Keygrip = 44D1BDC0C1931E2E018E7CE49CDE14BFB4EA11E3
sub rsa4096/0x8F192E4720BB0DAC 2018-11-25 [S]
Keygrip = 240966CBF2791D8C34D0DA646925435FED49F9BF
```
Now, open `~/.gnupg/sshcontrol` and paste the keygrip into that file.
It's the keygrip just below the key marked `[A]` for authentication.
Verify that the correct keygrip has been selected by running these two
and comparing the output:
```
$ ssh-add -L
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCakJKfXUuX/ZDxJQySdxCeQfxTu0g
KPCESGDyadvFAPDxtcTfOrxfqJLZx8CodkC7hzHT/QEy/xMgN18Q== cardno:000609861127
```
```
$ gpg --export-ssh-key <keyid>
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCakJKfXUuX/ZDxJQySdxCeQfxTu0g
KPCESGDyadvFAPDxtcTfOrxfqJLZx8CodkC7hzHT/QEy/xMgN18Q== openpgp:0x1CFEB507
```
The `ssh` output should match the `gpg` output (except maybe the little
trailing comment, like here). Also, I've removed most of the public key I'm using as
an example for brevity's sake. It should be quite a bit longer than this.
If `ssh` is correct, kill off `gpg-agent`
```
$ pkill gpg-agent
```
Then open up a new terminal and attempt to connect to a server!
[back](/)
|