Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Whenever I try to use gpg from a console-based environment such as ssh sessions it fails because the GTK pinentry dialog cannot be shown in a SSH session.

I tried unset DISPLAY but it does not help and it does look like a dirty solution anyway. The GPG command line options do not include a switch for forcing the pinentry to console-mode.

Older GPG versions offered a text-based prompt that worked fine in SSH sessions but after the upgrade it just fails.

There is the --textmode command line switch but it does not seem to work and apparently is meant to do something else which is even more misleading.

What would be the proper and clean way of getting plain-text pin entry for remote sessions?

share|improve this question
up vote 25 down vote accepted

To change the pinentry permanently, append the following to your ~/.gnupg/gpg-agent.conf:

pinentry-program /usr/bin/pinentry-curses

Tell the GPG agent to reload configuration:

echo RELOADAGENT | gpg-connect-agent
share|improve this answer
3  
It's not completely "sane". Normally, gpg-agent should itself detect the presence or lack of $DISPLAY and choose the apropriate pinentry... – grawity Dec 19 '12 at 15:00
    
The agent is most likely capable of detecting the presence of a running xorg. But having a DISPLAY defined does not necessarily mean I can or want to use it, for example, when connected over SSH. – ccpizza Dec 19 '12 at 17:34
7  
I won't comment on "want". But if you connect over SSH and DISPLAY gets set automatically, then it's usually because you activated X11-over-SSH forwarding which means you can use graphical pinentry promptres... – grawity Dec 19 '12 at 20:26
1  
You are right - I had X11 forwarding enabled. Never thought of the implications, though. Thanks again. – ccpizza Dec 19 '12 at 21:06
1  
@lfxgroove: the problem is that su does not change the ownership of your TTY, so you need to manually chown it. See this article. – Rufflewind Oct 9 '15 at 16:22

To prevent the pinentry popup you could ssh localhost. Optionally forcing X11 disabled, -x Disables X11 forwarding. See the full example below.

patrick@patrick-C504:~$ ssh localhost
patrick@localhost's password: 
Welcome to Ubuntu 14.04.3 LTS (GNU/Linux 3.13.0-68-generic x86_64)

 * Documentation:  https://help.ubuntu.com/

Last login: Mon Nov 16 22:48:53 2015 from localhost
patrick@patrick-C504:~$ gpg --gen-key
gpg (GnuPG) 1.4.16; Copyright (C) 2013 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Please select what kind of key you want:
   (1) RSA and RSA (default)
   (2) DSA and Elgamal
   (3) DSA (sign only)
   (4) RSA (sign only)
Your selection? 4
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 
Requested keysize is 2048 bits
Please specify how long the key should be valid.
         0 = key does not expire
      <n>  = key expires in n days
      <n>w = key expires in n weeks
      <n>m = key expires in n months
      <n>y = key expires in n years
Key is valid for? (0) 
Key does not expire at all
Is this correct? (y/N) y

You need a user ID to identify your key; the software constructs the user ID
from the Real Name, Comment and Email Address in this form:
    "Heinrich Heine (Der Dichter) <heinrichh@duesseldorf.de>"

Real name: Foo
Name must be at least 5 characters long
Real name: FooBar
Email address: foorbar@foo.bar
Comment: 
You selected this USER-ID:
    "FooBar <foorbar@foo.bar>"

Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
You need a Passphrase to protect your secret key.

gpg: gpg-agent is not available in this session
Enter passphrase:
share|improve this answer
1  
Which X11 features specifically should be disabled? I personally know the answer to my question, the author does not, so the answer seems incomplete without this information. – Ramhound Nov 17 '15 at 12:26
    
ssh'ing to local host was enough for me, but optionally -x Disables X11 forwarding. should prevent any X11 forwarding. Answer is updated. – PvdL Nov 18 '15 at 9:45
    
I prefer this solution, given that pinentry over -X doesn't show up – I'm normally physically at my laptop, where I want X pinentry (so I don't want to edit a conf file all the time), but if I happen to ssh -X into it I might still want a curses pinentry. Of course, ideally, the gtk pinentry would actually work over ssh -X :-/ – unhammer Jun 5 at 13:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.