1

I am trying to generate unattended OpenPGP keys without passphrase to automatically deploy secure files on servers.

When generated manually all goes fine (using gpg --no-permission-warning --homedir . --gen-key 2>&1), but in batch mode, nothing seems to be created.

Here is the test script:

#!/bin/bash
echo '-- Generating entropy'
sudo dd if=/dev/sda of=/dev/null &
TASK_PID=$!

#GPG Key parameters
cat > gpgparams <<EOF
%echo Generating a basic OpenPGP key
Key-Type: RSA
Key-Length: 2048
Subkey-Type: RSA
Subkey-Length: 2048
Name-Real: User Name
Name-Email: user@server
Expire-Date: 0
%pubring userserver.pub
%secring userserver.sec
%commit
%echo done
EOF

echo '-- Generating keys'
gpg --no-permission-warning --homedir . --batch --gen-key gpgparams 2>&1
echo "Result: $?"
echo "Files:"
ls -al

echo && echo '-- Killing entropy generator'
sudo kill $TASK_PID

echo && echo '-- Listing keys'
gpg --homedir . --list-keys

echo && echo '-- exporting public key'
gpg --homedir . --export -a user@server > pubkey.txt 2>&1
echo "Files:"
ls -al
echo "Content of public key:"
cat pubkey.txt

echo && echo '-- Printing versions'
echo '> Ubuntu version'
lsb_release -d
echo '> GPG version'
gpg --version --homedir .

And the result:

-- Generating entropy
-- Generating keys
gpg: keyring `./secring.gpg' created
gpg: keyring `./pubring.gpg' created
gpg: Generating a basic OpenPGP key
........+++++
...............+++++
..+++++
...+++++
gpg: done
Result: 0
Files:
total 28
drwx------ 2 user user 4096 Oct 24 11:12 .
drwxrwxr-x 9 user user 4096 Oct 23 23:11 ..
-rw-rw-r-- 1 user user  232 Oct 24 11:11 gpgparams
-rw------- 1 user user    0 Oct 24 11:11 pubring.gpg
-rw------- 1 user user  600 Oct 24 11:12 random_seed
-rw------- 1 user user    0 Oct 24 11:11 secring.gpg
-rwxrwxr-x 1 user user  918 Oct 24 11:11 testScript.sh
-rw-rw-r-- 1 user user 1461 Oct 24 11:12 userserver.pub
-rw------- 1 user user 2763 Oct 24 11:12 userserver.sec

-- Killing entropy generator

-- Listing keys
gpg: ./trustdb.gpg: trustdb created

-- exporting public key
Files:
total 36
drwx------ 2 user user 4096 Oct 24 11:12 .
drwxrwxr-x 9 user user 4096 Oct 23 23:11 ..
-rw-rw-r-- 1 user user  232 Oct 24 11:11 gpgparams
-rw-rw-r-- 1 user user   31 Oct 24 11:12 pubkey.txt
-rw------- 1 user user    0 Oct 24 11:11 pubring.gpg
-rw------- 1 user user  600 Oct 24 11:12 random_seed
-rw------- 1 user user    0 Oct 24 11:11 secring.gpg
-rwxrwxr-x 1 user user  918 Oct 24 11:11 testScript.sh
-rw------- 1 user user   40 Oct 24 11:12 trustdb.gpg
-rw-rw-r-- 1 user user 1461 Oct 24 11:12 userserver.pub
-rw------- 1 user user 2763 Oct 24 11:12 userserver.sec
Content of public key:
gpg: WARNING: nothing exported

-- Printing versions
> Ubuntu version
Description:    Ubuntu 15.04
> GPG version
gpg (GnuPG) 1.4.18
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: .
Supported algorithms:
Pubkey: RSA, RSA-E, RSA-S, ELG-E, DSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
        CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: MD5, SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

I mainly followed this documentation on unattended key generation, which is related to version 2 of gpg.

Am I missing something special about version 1? Is this related to entropy generation? Am I going wrong somewhere?

--

So here is the working script with use of --secret-keyring and --keyring flags:

#!/bin/bash
echo '-- Generating entropy'
sudo dd if=/dev/sda of=/dev/null &
TASK_PID=$!

#GPG Key parameters
cat > gpgparams <<EOF
Key-Type: RSA
Key-Length: 2048
Key-Usage: encrypt
Subkey-Type: RSA
Subkey-Length: 2048
Subkey-Usage: encrypt
Name-Real: User Name
Name-Comment: none
Name-Email: user@server
Expire-Date: 0
%pubring userserver.pub
%secring userserver.sec
%commit
%echo done
EOF

echo '-- Generating keys'
gpg --no-tty --no-permission-warning --homedir . --batch --gen-key gpgparams 2>&1
echo "Result: $?"
echo "Files:"
ls -al

echo && echo '-- Killing entropy generator'
sudo kill $TASK_PID

echo && echo '-- Listing keys'
gpg --homedir . --no-default-keyring --secret-keyring ./userserver.sec --keyring ./userserver.pub --list-secret-keys

echo && echo '-- exporting public key'
gpg --homedir . --no-default-keyring --secret-keyring ./userserver.sec --keyring ./userserver.pub --export -a user@server > pubkey.txt 2>&1
echo "Files:"
ls -al
echo "Content of public key:"
cat pubkey.txt
  • Are you sure you ran exactly this script? The newline escape sequences should never have been converted to newlines in single quotes. Otherwise, this works for me (running GnuPG 1). Would you add the output of an ls -la . ? – Jens Erat Oct 24 '15 at 7:46
  • The files exists but there is no key inside. – aklmie Oct 24 '15 at 8:17
  • Thanks for putting the light on the newlines problem. In fact, my main shell is ZSH and when adjusting my script for proper formatting in this post, I think I put some spaces before the first line comment. Thus, using ZSH... However, the main issue is still the same. I will update my post with requested infos. – aklmie Oct 24 '15 at 9:15
1

Looking at the file listing, the problem actually seems somewhat obvious: pubring.gpg and secring.gpg are way too small (well, empty).

Looking at the reason why, when generating keys, you specified userserver.pub respectively userserver.sec as targets, while the export command runs using the default locationspubring.gpg and secring.gpg.

Either remove those lines in the generation parameters:

%pubring userserver.pub
%secring userserver.sec

or run the export (and listing of key, of course) with additional parameters --keyring userserver.pub --secret-keyring userserver.sec.

  • You're right, you just precede me a little... As i found this in the documentation. And it was also in the v2 documentation linked in the original question. (RTFM! till the end !! :) )Thanks. – aklmie Oct 24 '15 at 9:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.