diff options
| author | Wheest <perry@gibsonic.org> | 2019-01-07 21:58:14 +0000 |
|---|---|---|
| committer | Wheest <perry@gibsonic.org> | 2019-01-07 21:58:14 +0000 |
| commit | b44f6131efe1cac4882197d9a42ee1726c77bf00 (patch) | |
| tree | 7bc03b6b84d1724521fc7e3d4e6b1ee4a5796685 /README.md | |
| parent | Improvements to Agent Forwarding section, following feedback in: (diff) | |
| download | YubiKey-Guide-b44f6131efe1cac4882197d9a42ee1726c77bf00.tar.gz | |
Further amendments to Agent Forwarding
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 22 |
1 files changed, 19 insertions, 3 deletions
@@ -1485,11 +1485,17 @@ $ gpgconf --list-dirs agent-socket This should return a path such as `/run/user/1000/gnupg/S.gpg-agent`. -- On your remote machine, edit the file `/etc/ssh/sshd_config`, so that option `StreamLocalBindUnlink` is set to `StreamLocalBindUnlink yes yes` +- On your remote machine, edit the file `/etc/ssh/sshd_config`, so that option `StreamLocalBindUnlink` is set to `StreamLocalBindUnlink yes` -- Agent forwarding should now be possible. +- _(optional)_If you do not have root access to the remote machine to edit `/etc/ssh/sshd_config`, you will need to remove the socket on the remote machine before forwarding works. For example, `rm /run/user/1000/gnupg/S.gpg-agent`. Further information can be found on the [AgentForwarding GNUPG wiki page](https://wiki.gnupg.org/AgentForwarding). -- To enable agent forwarding, add the following to your ssh config file (your agent sockets may be different): +- On your local machine, you need to copy your public keyring to your remote machine + +``` +$ scp .gnupg/pubring.kbx remote:~/.gnupg/ +``` + +- Finally, to enable agent forwarding for a given machine, add the following to your ssh config file (your agent sockets may be different): ``` Host remote @@ -1500,6 +1506,16 @@ Host remote You should then be able to use your YubiKey as if it were connected to the remote machine. +If you're still having problems, it may be necessary to edit your `gpg-agent.conf` file on both your remote and local machines to add the following information. + +``` +enable-ssh-support +pinentry-program /usr/bin/pinentry-curses +default-cache-ttl 60 +max-cache-ttl 120 +extra-socket /run/user/1000/gnupg/S.gpg-agent.extra +``` + # Troubleshooting - If you don't understand some option - read `man gpg`. |