8

I'm having a problem using the gpg-agent over ssh via a single command line.

Here is my configuration :

Server A : triggering the command via ssh.

ssh user@serverB "sudo -E /path/to/script.sh"

Server B : Executing the script requiring a passphrase signature.

System info : Ubuntu 12.04

I've setup the gpg-agent on the server B, I've added this configuration to the /home/user/.bashrc :

Invoke GnuPG-Agent the first time we login.                                                                          
# Does `~/.gpg-agent-info' exist and points to gpg-agent process accepting signals?                                    
if test -f $HOME/.gpg-agent-info && \
    kill -0 `cut -d: -f 2 $HOME/.gpg-agent-info` 2>/dev/null; then
    GPG_AGENT_INFO=`cat $HOME/.gpg-agent-info | cut -c 16-`
else
    # No, gpg-agent not available; start gpg-agent                                                                     
    eval `gpg-agent --daemon --write-env-file $HOME/.gpg-agent-info`
fi
export GPG_TTY=`tty`
export GPG_AGENT_INFO

Here is the configuration of the agent in /home/user/.gnupg/gpg-agent.conf :

enable-ssh-support
#1 year cache support
default-cache-ttl 31536000
default-cache-ttl-ssh 31536000
max-cache-ttl 31536000
max-cache-ttl-ssh 31536000
#debug-all

So in order to make this works, I connect to the serverB via ssh :

ssh user@serverB

The gpg-agent is started, I trigger manually the script:

sudo -E /path/to/script.sh

Then, the gpg-agent prompt me asking for a passphrase, once I've setup the passphrase, I can run the script again, and it's doing its task without asking for a passhprase.

My problem is, when I try to trigger it distantly, e.g. via :

ssh user@serverB "sudo -E /path/to/script.sh"

It seems that the gpg-agent is not working, because the script keeps asking me for a passphrase.

Edit:

I've added the following content to /etc/sudoers.d/user in order to trigger the script distantly without the sudo password and to keep the environment variables :

user ALL=(ALL)NOPASSWD:SETENV:/path/to/script.sh

Any ideas?

3
  • Forgive the question, but are you sure it's asking for a passphrase? With what you've shown above, I'd expect it to be asking for a password, to authenticate the sudo command.
    – MadHatter
    Dec 24, 2013 at 11:53
  • I've managed the sudoers file with a NOPASSWD for the user/command I try to run distantly. I may need to precise this too. It is asking me for a passphrase.
    – Tony
    Dec 24, 2013 at 12:02
  • OK, that makes sense; thanks for clarifying, I just wanted to make sure we weren't getting bitten by the obvious!
    – MadHatter
    Dec 24, 2013 at 12:18

1 Answer 1

1

When you login with ssh user@serverB then manually execute the script it will prompt you for the passphrase the first time, then when you execute the script shh-agent will provide the stored passphrase.

However when you run ssh user@serverB "sudo -E /path/to/script.sh you are doing a new login each time, and I don't think ssh-agent would support saving the passphrase over separate SSH logins.

Keychain appears to do what you require: http://www.funtoo.org/Keychain

With keychain, you only need to enter a passphrase once every time your local machine is rebooted. Keychain also makes it easy for remote cron jobs to securely "hook in" to a long running ssh-agent process, allowing your scripts to take advantage of key-based logins.

The current version of keychain supports gpg-agent as well as ssh-agent.

7
  • As far as ssh chains go, you are wrong. I do this many times a day; ssh from host A to host B, then onto C, and then to D, with the ssh-agent at the head performing key operations the whole time.
    – MadHatter
    Dec 24, 2013 at 12:21
  • My understanding is that he isn't trying to connect from A to B using the agent. Server B is setup as the ssh-agent client (for all intents and purposes) and when he executes sudo -E /path/to/script.sh on server B, something in here is requiring the passphrase. EDIT: Although, with your comment in mind, it may make more sense for him to configure A as the agent client, and use ssh-agent forwarding which it turn would allow him to execute the script on server B without it prompting for a passphrase.
    – v25
    Dec 24, 2013 at 12:28
  • Ok, I'll try to setup the gpg-agent on the server A. You got some information about ssh-agent forwarding? I've seen this post so far : superuser.com/questions/161973/…
    – Tony
    Dec 24, 2013 at 13:03
  • This is well documented, here's a guide: livecipher.blogspot.co.uk/2013/02/ssh-agent-forwarding.html
    – v25
    Dec 24, 2013 at 13:31
  • v25, my apologies, looks like you were right. Tony, it'll never work if you run the agent on B, because the connection isn't persistent.
    – MadHatter
    Dec 24, 2013 at 13:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .