I have a Yubikey4 loaded with my gpg-key, acting as a smartcard. I can do gpg2 card-status and it gives me the whole shebang showing all my subkeys and everything is fine.

I then wanted to use gpg-agent to ssh into remote hosts using my gpg key. I added the following to my ~/.gnupg/gpg-agent.conf

pinentry-program /usr/bin/pinentry-curses
default-cache-ttl 60

I also set the SSH_AUTH_SOCK in my .bashrc as this:

export SSH_AUTH_SOCK=~/.gnupg/S.gpg-agent.ssh

If I then reboot my machine, the key is added and visible with ssh-add -l

4096 SHA256....... cardno: ..... (RSA)

But any attempts to ssh to a remote server just hangs, ssh -vvv tells me the machine tries to sign and send the key, but the agent refuses operation.

If I then execute a script I made using various sources it all works.

   killall gpg
   export SSH_AUTH_SOCK=~/.gnupg/S.gpg-agent.ssh; gpg-agent --daemon --keet-tty --use-standard-socket --pinentry-program=/usr/bin/pinentry-curses 

I tried implementing this using bashrc, executing it with my deskopt-manager and a user systemd task to no avail.

Can anybody help me figure out how to start this automatically on login, without the need to execute "my script"?

  • The one little thing I could think of is make sure that all your gpg related agents are all the same version. I notice you're running gpg2 as the command, and with killall gpg resolving the issue, my naive assumption is that either scdaemon or gpg-agent is an old version. – plttn Mar 13 '18 at 19:25

Short answer :

Execute as root :

$ echo enable-ssh-support >> ~/.gnupg/gpg-agent.conf
# editor /etc/X11/Xsession.options
    ... comment out "use-ssh-agent" ...
# aptitude purge libpam-gnome-keyring

Logout off your desktop session and login again, and check that $SSH_AUTH_SOCK is pointing at your gpg-agent.

Explanation :

By default, the gpg-agent doesn’t enable its SSH agent. This is done either by passing --enable-ssh-support on the command-line or by adding a line to a configuration file as above.

Second, the problem of other SSH agents. The OpenSSH agent starts by default, set up by /etc/X11/Xsession.d/90x11-common_ssh-agent from the x11-common package. If running GNOME, the GNOME Keyring agent is running as well. Both of those will interfere with our GnuPG agent.

Disabling the OpenSSH agent is by editing /etc/X11/Xsession.options as above.

Disabling the GNOME Keyring agent is potentially a bit more complicated. Using Xfce, one can un-install the libpam-gnome-keyring package and ensure that Xfce doesn’t start GNOME services (Settings → Session and Startup → Advanced → Launch GNOME services on startup – untick if ticked).


If after all this SSH_AUTH_SOCK is still not pointing at your gpg-agent, you may have another agent still interfering with your GnuPG agent. The SSH_AGENT_PID variable should contain the PID of the agent process, which will help to pinpoint that agent.

Source : My Perfect GnuPG / SSH Agent Setup


Put the script in /etc/profile.d. Make sure you executable bit set (chmod +x) and the file has a .sh extension.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.