6

I'm setting up a backup from a local machine to a remote server.
I generated gpg keys on the local machine and ran a test backup with:

PASSPHRASE="MyGPGPassphrase" duplicity --encrypt-key KeyID test scp://user@server/path

The backup seems to work fine, three files are created on the server.

My problem is I can't get the restore to work.
I deleted the test file on the local machine and try to restore it with:

PASSPHRASE="MyGPGPassphrase" duplicity --encrypt-key KeyID scp://user@server/path test

I get the following error:

Synchronizing remote metadata to local cache...
Copying duplicity-full-signatures.20151011T011134Z.sigtar.gpg to local cache.
GPGError: GPG Failed, see log below:
===== Begin GnuPG log =====
gpg: encrypted with 2048-bit RSA key, ID KeyID(of ssb), created 2015-10-11
"Name <email>"
gpg: public key decryption failed: Inappropriate ioctl for device
gpg: decryption failed: No secret key
===== End GnuPG log =====

I exported the gpg keys on the local machine with:
gpg --export-secret-key KeyID > secret.key
gpg --armor --export KeyID > public.key

And imported them on the server with:
gpg --import secret.key
gpg --import public.key

Is there anything else that needs to be done for the restore to work?

Edit:
If I execute the command without the PASSPHRASE env duplicity --encrypt-key Key D test scp://user@host/path the backup is created anyway without asking for the passphrase.

Output of file duplicity-full.20151011T115714Z.vol1.difftar.gpg lists a different KeyID then the one specified in --encrypt-key. I dont have the listed key in my keyring.

3
  • Are you sure you imported the keys to the correct user? GnuPG uses per-user key chains, services often use some system user with it's own key ring instead. – Jens Erat Oct 11 '15 at 8:32
  • There is only one user (root) on the remote machine. – Pabi Oct 11 '15 at 11:10
  • Could be related to this. In short: Somehow gpg fails to ask for the passphrase. – Daniel B Oct 11 '15 at 12:17
6

The problem is, like the linked post stated, that gpg 2.1 retires passphrase from pipe for key auth.
The gpg agents needs to be enabled and configured for the restore to work.

Add the following to ~/.gnupg/gpg.conf:

use-agent
pinentry-mode loopback

And to your ~/.gnupg/gpg-agent.conf:

pinentry-program /usr/bin/pinentry-gtk-2
allow-loopback-pinentry

Then restart the agent with echo RELOADAGENT | gpg-connect-agent.

The restore work even if the keys are only on the local machine. I still don't get why it does not ask for the passphrase when making incremental though.

1
  • 2
    The second filepath is missing the dot. It should be ~/.gnupg/gpg-agent.conf (same directory as the previously mentioned file). – Sam Oct 23 '18 at 10:40
1

Are you using gpg 2.1? if yes, duplicity and gpg need some extra parameters if you want to deliver the passphrase via env var.
https://lists.launchpad.net/duplicity-team/msg02653.html

Alternatively simply do not set PASSPHRASE and gpg-agent will ask you and memorize the secret for you.

2
  • I am using gpg 2.1.8. If I run it without the passphrase env: duplicity --encrypt-key KeyID test scp://user@host/path it does not ask for the passphrase but the backup is created anyway. – Pabi Oct 11 '15 at 11:59
  • After doing that the output of file duplicity-full.20151011T115714Z.vol1.difftar.gpg lists a different KeyID then the one specified in --encrypt-key. I dont have the listed key in my keyring. – Pabi Oct 11 '15 at 12:09
1

I have had this issue when using sudo to execute duplicity, which makes it search for the private key into root's home directory. Not finding the private key on it, the "No secret key" error appears and -at least for me- was not immediately clear why.

The most simple solution to this problem was to avoid using sudo, in my case, by setting the correct permissions on the destination directory.

If sudo is a must, then the appropriate GPG options need to set so it uses the user's GPG keychain: adding --gpg-options "~user/.gnupg" to the duplicity command, as stated on this answer

Maybe this helps someone else :-)

2
  • So how did you resolve exactly? – Drink More Pimp Juice IT Jul 18 '17 at 19:21
  • 1
    D'oh. Added to the answer. Thanks for pointing it out. – Pablo Jul 18 '17 at 20:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.