2

Preamble

My understanding of gpg and ssh is medium-technical as a programmer and crypto-fan, but I'm not a huge pro in either's nitty-gritty details like configuration, "trivia" like alphabet soup specs, magic variables, and interoperation. I've been through a few hours of reading guides and troubleshootings, and a few years of light linux server use, and I've gotten through much so far, but I'm stuck now.

Goal

To set up gpg4win with a master key with 1 auth subkey, that lets me authenticate in git and ssh via gpg-agent with a password prompt via gpg4win.

Sitrep

Windows 10 pc, linux server on LAN for testing. ssh, putty, kitty, and pageant already set up and working with an older gpg key + derived putty key of mine. Kleopatra shows everything to be working, password prompt and gpg-agent included. gpg4win 3.1.7, gnupg 2.2.15, putty/kitty 0.71.

I've generated a new master key 9B59 for myself using ECC (ed25519), Certify-only. Generated 2 ECC subkeys (1 Encrypt, 1 Authenticate+Sign).

AS subkey:

  • id = F3DC
  • keygrip = 3289...224A
  • gpg --export-ssh-key ... = ssh-ed25519 AAAAC3Nz... openpgp:0x6146F3DC.

AS subkey keygrip added to ~\gnupg\sshcontrol, ssh key added to server's ~/authorized_keys.

gpg-agent running with --enable-putty-support --enable-ssh-support. Trying to run pageant fails with an error that "pageant is already running", indicating that ssh support is online (and no, there is no instance of pageant running).

SSH_AUTH_SOCK env var = C:\Users\me\AppData\Roaming\gnupg\S.gpg-agent.ssh. This file exists, is always "last modified on" at the time of gpg-agent starting, and contains some binary foobar.

gpg-connect-agent -r keyinfo_list.txt reported (among other keys):
S KEYINFO 3289...224A D - - - P - - -

Trying to authenticate to my ssh server at this point failed against my expectation with "no supported auth methods (publickey)", and did not prompt for my password via gpg4win.

After performing an operation in Kleopatra to force the key to be loaded, the previous output changed to
S KEYINFO 3289...224A D - - 1 P - - -
so my AS subkey F3DC is correctly loaded and cached.

At this point authentication through putty/kitty using "pageant" (= gpg-agent) still did not work.

The putty event log of the failed login shows: 

Event Log: Pageant is running. Requesting keys.
Event Log: Pageant has 0 SSH-2 keys

Q

Why is gpg-agent not offering to use my AS subkey despite it being loaded in gpg-agent, set in sshcontrol, and listed in my authorized_keys?

Improve this question
1
  • I have also tried the same process with an RSA subkey (in an ECC master key), and the result is the same. – Marnes May 4 '19 at 15:41
2

Ok, so turns out 2 things were wrong:

  1. sshcontrol is very iffy yet silent about line endings (last line must end with a line terminator)
  2. you have to start gpg-agent-connect with --homedir <your gnupg folder>
Improve this answer
2
  • just confirming that I followed the steps in OP on a new computer and it worked right away. Having your key imported, adding it to sshcontrol (and obviously your server's authorized_keys), enabling ssh/putty support, and setting SSH_AUTH_SOCK is all you need to do. – Marnes May 9 '19 at 12:09
  • Confirmed - I've also found that Kleopatra starts the agent properly with the home directory set. You may want to try that first – Kevin Deenanauth Jan 6 '20 at 20:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.