Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

GnuPG can, with gpg-agent, cache access to a private key. How can I keep that cache active for the entire user session?

When I unlock the key for gpg-agent, it only stays cached for a limited time. With SSH's agent, I enter the passphrase one time and it stays cached for the whole session. I want the same behaviour from gpg-agent.

So, ssh-agent doesn't suffer from a limited cache lifetime. But gpg-agent has limits the cache lifetime, at least by default. How can I eliminate the limit on cache time from gpg-agent?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Up to GnuPG 2

The user configuration (in ~/.gnupg/gpg-agent.conf) can only define the default and maximum caching duration; it can't be disabled.

The default-cache-ttl option sets the timeout (in seconds) after the last GnuPG activity (so it resets if you use it), the maximum-cache-ttl option set the timespan (in seconds) it caches after entering your password. The default value is 7200 (2 hours) for both.

Set it to a year or so – say, 34560000 seconds (400 days) – and you should be fine:

default-cache-ttl 34560000
maximum-cache-ttl 34560000

But for this change to take effect, you need to end the session by restarting gpg-agent.

If you want to limit to your session length, you'd need to kill the daemon at logout. This is very different between operating systems, so I'm referring to another question/answer containing hints for different systems.

You could also restart the gpg-agent during login, but this does not limit caching time to the session length, but logins of a user. Decide yourself if this is a problem in your case.

GnuPG 2.1 and above

In GnuPG 2.1 and above, the maximum-cache-ttl option was renamed to max-cache-ttl without further changes.

share|improve this answer
    
Is this a “you can't do what you're asking” response? It's not clear, since you're talking about limiting the session length or limiting caching time. I want exactly the opposite of that: no arbitrary limit on the cache time or session length. –  bignose Jul 29 '13 at 0:58
    
Kind of that, you can only workaround by setting a rather huge ttl. Set it to a year or so and you should be fine - but need to end the session by restarting gpg-agent. –  Jens Erat Jul 29 '13 at 8:12
    
Please note that in latests versions (at least gnupg 2.1), the maximum-cache-ttl option doesn't exist. To see the correct options, see the official documentation: gnupg.org/documentation/manuals/gnupg/… –  pablox 12 hours ago
    
Thank you, I included this information in the answer. –  Jens Erat 11 hours ago

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.