3

If I open a gnome terminal and connect to a server through SSH, I am asked for my passphrase by a text prompt in my terminal instead of a GUI, and, worse, this passphrase is not stored in memory for the duration of my Ubuntu session.

On the contrary, I use PGP keys with Enigmail in Thunderbird, and I have to enter my passphrases only once per session, using a GUI.

It seems I have 3 agents installed and running: seahorse-daemon, gpg-agent and ssh-agent, and they do not seem to play along nicely. I have a gnome-keyring running, too. I do not understand what each of these programs is supposed to do.

ssh-agent is run by my system with "/usr/bin/gpg-agent" as first command argument, and I do not understand what this means.

How can I set up which agent to use for ssh keys ?

3 Answers 3

2

I do not use the GUI util in "settings" -> "passwords and keys"

I have installed keychain.

sudo apt-get install keychain

If you're running bash you need to add a few commands to your .bash_profile If you do not have a .bash_profile create one in your home folder. Add these lines:

### START-Keychain ###
# Let  re-use ssh-agent and/or gpg-agent between logins
/usr/bin/keychain $HOME/.ssh/id_dsa
source $HOME/.keychain/$HOSTNAME-sh
### End-Keychain ###

At the start of a work day I will login. When I open a terminal, I will be prompted once for my passphrase. For all other new terminals and connections I will not be asked for my passphrase again.

1

Run ssh-add in a terminal, and type in your passphrase when prompted. If this works, then every subsequent access to your ssh key should just work without any prompting, in all terminals and applications running in the same X session.

0

I did a lot of testing and research to find out that most of the documents are out of date, here is a simple and yet effective way to get it working.

At the bottom of your .bashrc file just put this in:

# use a tty for gpg
# solves error: "gpg: signing failed: Inappropriate ioctl for device"
GPG_TTY=$(tty)
export GPG_TTY
# Start the gpg-agent if not already running
if ! pgrep -x -u "${USER}" gpg-agent >/dev/null 2>&1; then
    gpg-connect-agent /bye >/dev/null 2>&1
    gpg-connect-agent updatestartuptty /bye >/dev/null
fi
# Set SSH to use gpg-agent
unset SSH_AGENT_PID
if [ "${gnupg_SSH_AUTH_SOCK_by:-0}" -ne $$ ]; then
    export SSH_AUTH_SOCK="${HOME}/.gnupg/S.gpg-agent.ssh"
fi
# add alias for ssh to update the tty
alias ssh="gpg-connect-agent updatestartuptty /bye >/dev/null; ssh"

Hope this saves someone the headache of revewing old documentation.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .