How to properly start gpg-agent on Ubuntu 16.04

Question

I have a Yubikey4 loaded with my gpg-key, acting as a smartcard. I can do gpg2 card-status and it gives me the whole shebang showing all my subkeys and everything is fine.

I then wanted to use gpg-agent to ssh into remote hosts using my gpg key. I added the following to my ~/.gnupg/gpg-agent.conf

enable-ssh-support
pinentry-program /usr/bin/pinentry-curses
default-cache-ttl 60

I also set the SSH_AUTH_SOCK in my .bashrc as this:

export SSH_AUTH_SOCK=~/.gnupg/S.gpg-agent.ssh

If I then reboot my machine, the key is added and visible with ssh-add -l

4096 SHA256....... cardno: ..... (RSA)

But any attempts to ssh to a remote server just hangs, ssh -vvv tells me the machine tries to sign and send the key, but the agent refuses operation.

If I then execute a script I made using various sources it all works.

   killall gpg
   export SSH_AUTH_SOCK=~/.gnupg/S.gpg-agent.ssh; gpg-agent --daemon --keet-tty --use-standard-socket --pinentry-program=/usr/bin/pinentry-curses 

I tried implementing this using bashrc, executing it with my deskopt-manager and a user systemd task to no avail.

Can anybody help me figure out how to start this automatically on login, without the need to execute "my script"?

Answer 1

Short answer :

Execute as root :

$ echo enable-ssh-support >> ~/.gnupg/gpg-agent.conf
# editor /etc/X11/Xsession.options
    ... comment out "use-ssh-agent" ...
# aptitude purge libpam-gnome-keyring

Logout off your desktop session and login again, and check that $SSH_AUTH_SOCK is pointing at your gpg-agent.

Explanation :

By default, the gpg-agent doesn’t enable its SSH agent. This is done either by passing --enable-ssh-support on the command-line or by adding a line to a configuration file as above.

Second, the problem of other SSH agents. The OpenSSH agent starts by default, set up by /etc/X11/Xsession.d/90x11-common_ssh-agent from the x11-common package. If running GNOME, the GNOME Keyring agent is running as well. Both of those will interfere with our GnuPG agent.

Disabling the OpenSSH agent is by editing /etc/X11/Xsession.options as above.

Disabling the GNOME Keyring agent is potentially a bit more complicated. Using Xfce, one can un-install the libpam-gnome-keyring package and ensure that Xfce doesn’t start GNOME services (Settings → Session and Startup → Advanced → Launch GNOME services on startup – untick if ticked).

Troubleshooting

If after all this SSH_AUTH_SOCK is still not pointing at your gpg-agent, you may have another agent still interfering with your GnuPG agent. The SSH_AGENT_PID variable should contain the PID of the agent process, which will help to pinpoint that agent.

Source : My Perfect GnuPG / SSH Agent Setup

Answer 2

Put the script in /etc/profile.d. Make sure you executable bit set (chmod +x) and the file has a .sh extension.