I'm behind a company firewall and I'd like to be able to run this:

gpg --keyserver-options auto-key-retrieve --verify somesoftware.tar.bz2.sig somesoftware.tar.bz2

I need a list of servers that GPG searches/retrieves keys so that I can request port 11371 be opened to those servers.

How do I get the list of servers/databases that gpg searches for keys?

  • --locate-keys? – JakeGould Feb 26 '18 at 13:04
  • 1
    gpg --locate-keys seems to be for finding keys installed locally, gpg --auto-key-locate doesn't list the servers searched / available for key retrieval. – irritable_phd_syndrom Feb 26 '18 at 15:33
  • Ahh! Makes sense. – JakeGould Feb 26 '18 at 15:44

Generally it's whatever you've specified in the keyserver option (either in command line, or in ~/.gnupg/gpg.conf, or recently even in ~/.gnupg/dirmngr.conf).

The default may vary depending on version and distribution. However, in most cases it's a large pool of servers (usually the SKS pool), where the actual server addresses may change frequently. If you are behind a firewall which requires whitelisting, you should always configure the server manually.

Latest GnuPG 2.2.x actually use the SKS "hkps" pool, which only needs port 443 (HTTPS) and should work with most firewalls. (It does however require DNS SRV record support.)

gpg --keyserver hkps://hkps.pool.sks-keyservers.net:443 ...

Note that SKS even provides a "p80" pool, which speaks HKP entirely over port 80 (the standard HTTP port) and should work with any firewall or proxy server. For example:

gpg --keyserver hkp://p80.pool.sks-keyservers.net:80 ...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.