View Source: GpgAgentNotes - Waikato Linux Users Group

Edit PageHistory Diff Info LikePages
!!Using GPG with an agent

Like [SSH], [GPG] lets you use an agent to cache your PassPhrase in memory for a time, and provide it back to GPG when you would otherwise have to retype it.

On Debian/Ubuntu:

<tt>apt-get install gnupg-agent pinentry-curses</tt>

pinentry is a program to securely accept your passphrase.  There are GTK and QT versions available for X users.

To start the GPG agent, run <tt>eval `gpg-agent --daemon`</tt> (I keep this in my ~/.bashrc).

You configure the agent in ~/.gnupg/gpg-agent.conf.  A sample:
<pre>
default-cache-ttl 3600
pinentry-program /usr/bin/pinentry-curses
</pre>

This caches the pin for 3600 seconds (1 hour) and uses the curses (text mode) pin entry program.

The first time you run gpg, and would have to enter your passphrase, the pinentry program will pop up and ask for it for you.  It will then be cached for the defined TTL, so you won't be asked for it again.  This is useful if you're doing anything that does more than one GPG operation, such as running a script to sign two files.

!!I am not prompted for a passphrase when I should be

<pre>
You need a passphrase to unlock the secret key for
user: "IT Partners <packages@itpartners.co.nz>"
1024-bit DSA key, ID xxxxxxx, created 2005-04-21

gpg: cancelled by user
gpg: skipped "xxxxxxxx": bad passphrase
</pre>

Why wasn't I prompted for the passphrase?  pinentry-curses needs a [TTY], and if you don't have GPG_TTY set, it won't be able to find one if you're running from a script.

<tt>GPG_TTY=`tty`</tt> in your .bashrc will fix this for you.


----
!!Experience getting gpg going with KMail on Kubuntu 7.04

<tt>apt-get install gnupg-agent pinentry-qt kgpg gnupg2</tt>

pinentry is a program to securely accept your passphrase.  The QT version pinentry-qt is suitable for KDE users.

To start the GPG agent, run <tt>eval `gpg-agent --daemon --write-env-file`</tt> (Keep this in ~/.bashrc or ~/.xsession).

This writes a file ~/.gpg-agent-info and prevents additional gpg-agents starting (I think?). The environment variable GPG_AGENT_INFO get its value from here and this is where KMail figures which gpg-agent to talk with.

You configure the agent in ~/.gnupg/gpg-agent.conf.  A sample:
<pre>
default-cache-ttl 3600
pinentry-program /usr/bin/pinentry-qt
</pre>

Configure ~/.gnupg/gpg.conf to use the gpg-agent you've just got going.
Uncomment the option <tt>use-agent</tt>

If the file does not exist you can use Kgpg to create the file for you.  However the file it only include one keyserver. You can add the others to this file.

Configure ~/.bashrc to include

<tt>GPG_TTY=`tty`</tt> and
<tt>export GPG_TTY</tt>






-----
Find other pages like me in CategoryNotes
One page links to GpgAgentNotes:
Last edited on Friday, July 27, 2007 12:40:10 am by "ChrisOh"
Edit PageHistory Diff Info LikePages