Questions tagged [gpg]

GNU Privacy Guard (GnuPG or GPG) is OpenPGP compliant FOSS alternative to PGP encryption software.

Filter by
Sorted by
Tagged with
-2
votes
1answer
81 views

How fast is decryption by a YubiKey? [closed]

Do YubiKeys decrypt GPG or SSH/SFTP data directly within themselves? If so, would that cause a bottleneck? Do YubiKeys have accelerated AES hardware that does most of the heavy lifting of decryption? ...
0
votes
2answers
257 views

Ubuntu add repo app-key fails

On Ubuntu 20.04 LTS, I'm trying to install packages like MongoDB, Sublime Text 3 etc. but before adding them their repo url must be added. I'm trying this command: wget -qO - https://download....
0
votes
0answers
24 views

`pass` not asking for password anymore - gnome-keyring or gpg-agent related? How can I force password asking?

I have gnome-keyring running for sure, not sure it's gnome-keyring or gpg-agent or ssh-agent related... I use pass as command line password manager for many things. Usually, when querying pass, a ...
2
votes
1answer
56 views

Can't connect to server via SSH using gpg-agent

I'm trying to connect to a VM on Google Cloud. I've created a public key to use for SSH and added the key to the cloud instance. I have SSH_AUTH_SOCK set to the file used by gpg-agent. ~/.gnupg/gpg-...
1
vote
1answer
40 views

Trust gpg key via script

When performing an automated server deployment, I can upload and import gpg keys via script. But I cannot trust keys. I tried gpg --batch --yes --edit-key keyname trust 5 and echo 5 | gpg --batch -...
0
votes
0answers
55 views

GPG disabling ssh support for an authentication key coming from a smartcard

When a gpg smartcard (e.g. yubikey) is inserted and contains an authentication key, the key is automatically enrolled by the gpg-agent. That means the key is usable for any ssh operation without ...
1
vote
2answers
59 views

GPG I am trying to create a script to automaticaly associate an imported ssh key to a primary key

I am trying to attach an imported ssh key to an existing primary key. The imported ssh key exists inside ~/.gnupg/private-keys-v1.d/ and is usable through the gpg-agent. When I associate it manually ...
0
votes
1answer
96 views

Is it possible to setup msmtp for proper authentification in a Dockerfile?

I am running a php:7.2-apache container and I want to send mails. As ssmtp is retired, I want to use msmtp but I face authentication problems with msmtp. My goal: Setup msmtp for a docker container ...
0
votes
0answers
29 views

Yubikey won't receive an imported SSH auth key

I had a SSH key which I imported without problems in my GPG keyring as auth key using pem2openpgp from monkeysphere. The imported key works fine. I removed its SSH version from ~/.ssh and switched ...
0
votes
0answers
64 views

GPG integration with Active Directory

Can GPG use a Windows Certificate Authority as a public key repository? We have a new project where managers approve files with a digital signature. Windows doesn't have a native app for digitally ...
1
vote
0answers
66 views

Use ssh key on GPG card to decrypt data

When a Windows instance is created in AWS, its password is encrypted using the public part of an SSH key. It's then possible to use the following command to retrieve the encrypted password: aws ec2 ...
0
votes
1answer
816 views

gpg: no valid OpenPGP data found [closed]

I am trying to make sense of the following two serverfault posts: How to verify a file using an asc signature file? and gpg --import bind-9.9.4.tar.gz.sha1.asc fails with no valid OpenPGP data ...
0
votes
0answers
48 views

Fix or explain tty issue and gpg2

I'm having an issue importing or generating gpg secret keys on ubuntu 18.04 with my main (sudo) non-root user. With root user I have no problems with gpg, but non-root and it's basically permission ...
0
votes
0answers
27 views

How to scriptably and securely verify a GPG key's signatures offline

Given a GPG keychain, with one (or more) imported and trusted GPG public keys for key signing, I want to verify from a shell script that a given public key has been signed by a key already trusted in ...
1
vote
1answer
122 views

How to lock / unlock a gpg hardware token via script

I would like to execute gpg --card-edit; verify; quit non-interactively to unlock a gpg hardware token (i.e. smartcard or yubikey). My usecase is: Enter a password e.g. via ssh Store it in the ...
2
votes
1answer
2k views

gpg-agent: fatal error in syslog on ssh login

In the syslog for my Ubuntu server, there is an error that appears whenever I log in using an SSH user account. systemd[27299]: usr/bin/gpg-agent failed (exitcode=2): General error systemd[27299]: ...
3
votes
1answer
2k views

Unable to generate GPG keys without passphrase on Ubuntu 18.04 [closed]

Has anyone tried creating GPG keys for encrypted pillars on Ubuntu 18.04? I'm using the following command to attempt to generate the keys: gpg --gen-key --homedir /etc/salt/gpgkeys When I run that ...
1
vote
1answer
243 views

Where does duplicity store the key that it creates?

I started a backup via duplicity without giving it any options. I haven't created any GPG keys myself, so when I ran duplicity, it asked me for a passphrase, then created a key, and successfully ...
1
vote
1answer
163 views

What is the Devuan equivalent of the Debian debian-archive-keyring package?

Debian keeps the keys required for a successful multistrap installation in a package called debian-archive-keyring. (Multistrap is like debootstrap, but it can install packages from multiple ...
3
votes
1answer
490 views

How do I successfully import public key 94532124541922FB into GPG?

I think I need to have the key 94532124541922FB in my keyring as multistrap is reporting: W: GPG error: http://packages.roundr.devuan.org/merged ascii InRelease: The following signatures couldn't be ...
0
votes
0answers
112 views

Multiple files encrypted with multiple GPG keys - how to easily add/remove/manage keys, automate key change tasks?

We have a bunch of files that contain sensitive information, that need to be accessed by several teams, but need to be unreadable to everyone else. Currently, each team member needs to generate their ...
1
vote
1answer
130 views

How to export GPG key without user interaction?

I use GPG keys to encrypt backups with duplicity, so I would like to export the key after it is generated, so I can move it to a backup location in case the server burst into flames. Is there any way ...
2
votes
1answer
248 views

How to get only the pub part of gpg --list-public-keys?

Okay, there is probably a better way to phrase this question. I am writing a script to configure my web servers on the first boot, but I hit a snag when generating the GPG key that will be used to ...
0
votes
1answer
2k views

Problematic apt-get update due to missing gpg keys

I accidentally deleted some Debian gpg keys when testing out apt-key del. (I don't remember which key) I have redownloaded the deb package and extracted the gpg keys. Then I used apt-key add to add ...
0
votes
1answer
260 views

Aptly publish asking for password although --passphrase flag is set

I unsuccessfully try publishing an APTLY snapshot (about 80GB) using aptly publish snapshot --batch=true --passphrase="SuperSecretPassWord" --distribution="mydistro" current-snapshot After about 15 ...
0
votes
0answers
133 views

Where is the networker public key?

I am trying to install a networker backup client on linux (CentOS). At the moment I have to use "yum install --nogpgcheck" to do this, since I could not find the public gpg-key for their rpms. ...
0
votes
1answer
125 views

rhel7 yum repository metadata GPG signatures

I'm trying to sign yum repo metadata using GPG, as part of a Jenkins job. This is proving more difficult than I first imagined, but I'm sure lots of people must have done this already. I've worked ...
0
votes
1answer
116 views

Have Duplicity use user's persistent gpg session when performing full filesystem backup?

I'm trying to set up automatic, full filesystem backups on my local system using Duplicity. I do not want to have to enter my password for it to encrypt a volume: what if I am not at the computer and ...
3
votes
1answer
2k views

How to reposync saltstack? reposync failing with error message `Removing […], due to missing GPG key.`

On a RHEL 7.4 system, I add the salt-latest repo as follows: yum -y install https://repo.saltstack.com/yum/redhat/salt-repo-latest-2.el7.noarch.rpm Notice, amongst other things, this creates the ...
1
vote
1answer
1k views

How to setup logrotate with GPG to encrypt for GDPR?

As per GDPR all private data should be encrypted, so I need to encrypt all logs and retrieve them for auditing. I have chosen to perform the encryption during log rotation and to use GnuPG as my ...
4
votes
3answers
994 views

Force the use of a gpg-key as an ssh-key for a given server

I configured ssh to use GPG as my ssh-agent and if I remove the ~/.ssh folder, I can ssh into my server fine using my gpg key. However, my ~/.ssh folder has over a dozen different ssh keys in it, and ...
2
votes
2answers
5k views

How to remove a yum repo GPG key?

I have a custom RPM repo in Artifactory, and GPG signing keys were recently enabled. When I ran sudo yum check-updates I was prompted to add the key: Retrieving key from https://artifactory.example....
16
votes
1answer
20k views

How to verify a file using an asc signature file?

As an example, this project offers an *.asc file with a PGP signature to verify the contents of the download (as opposed to a checksum, you can see the empty column): https://ossec.github.io/downloads....
2
votes
1answer
432 views

force ssh to use agent, without fallback to directly accessing the IdentityFile

Company policy requires some ssh keys to be stored securely, e.g. on dedicated USB device. Using keys not stored on the host machine works flawlessly using gnupg with enable-ssh-support, even when ...
3
votes
0answers
2k views

Export Private ed25519 Key From GnuPG For Use in SSH

Is there a way to create an id_ed25519 (not id_ed25519.pub) file from an ed25519 keypair stored in GnuPG? I've started keeping track of my SSH keys in GPG: sec rsa3072 2017-12-12 [C] ...
1
vote
1answer
590 views

Querying SKS (PGP key server) database directly?

I have an SKS server set up on Ubuntu 16, currently with a manifest of keys from dumps provided by the MIT PGP key server. I'd like to be able extract public keys / subkeys and associated user info (...
5
votes
2answers
1k views

Why do I get this APT warning: Signature by key […] uses weak digest algorithm (SHA1)?

I'm hosting a private Debian repository for some custom Raspberry Pi code. I originally built the software on Raspbian Jessie (version 8), generated a GPG key which I use to sign the repository, and ...
0
votes
1answer
437 views

How can I host my public GPG key on S3?

I've been packaging some proprietary software that runs on Raspbian into .deb files and hosting them in a private S3 bucket using a program called deb-s3. I also use a program called apt-transport-s3 ...
1
vote
1answer
2k views

mongodb 10gen repo invalid signature

I am trying to install mongodb on debian from 10gen repo. I have followed the official guide HERE however i am stuck when trying to add the repo in apt. The problem is that the signature is invalid. ...
1
vote
0answers
143 views

How to auto update the expired GPG keys of APT?

When you create your own APT repo, you have to create a GPG key for it. So you need to import it with: apt-key add yourkey.asc or with a key server: apt-key adv --keyserver keyserver.ubuntu.com --...
1
vote
1answer
1k views

GPG signed aptly repository not working as expected

We host some of our own software packages as debs in a repository of our own. For prototyping purposes, we’ve been running “unauthenticated”. Now we're trying to do things more correctly and do the ...
2
votes
1answer
3k views

How to restore a Duplicity backup to a new host?

Had a catastrophic failure on a RAID array and lost everything. Have a full set of backups on S3 via duplicity (2003 files), encrypted with GPG. I have the passphrase and a copy of the private key ...
0
votes
1answer
464 views

How to share or encrypt sensitive git repos

My organization is using Openshift for running several applications. Our policy thus far has been to always store sensitive values (DB passwords, API keys, etc) in environment variables and never as ...
2
votes
1answer
551 views

Signing debian repository: Avoided SHA1, apt-get update still complaining about weak digest

I maintain a small debian repository for my employer, and we have been facing issues lately due to the SHA1 deprecation. We sign our packages with a 4096bit RSA key. For signing the repository, I ...
4
votes
2answers
896 views

Add second sub-key to unattended GPG key

I am writing a bash script which generates unattended GPG keys, I have looked through Unattended Usage of GPG and was surprised to find that 'Currently only one subkey can be handled.' I am unable to ...
0
votes
1answer
205 views

Where and how properly keep my private and public gpg keys?

What's the proper way to keep safe and backup my private and public gpg keys? Can I keep them both in the same place on a flash usb stick, is there any security about that? Or should I necessarily ...
3
votes
1answer
1k views

How can I set up automated, encrypted backups of live MySQL databases on a Ubuntu VPS to Google Drive using Duplicity?

We're using DigitalOcean as our VPS provider. They have a tutorial on how to set up Duplicity for encrypted backups, but it doesn't cover database backups or the Google Drive endpoint. I found a few ...
1
vote
1answer
2k views

Apache doesn't want to load GnuPG PHP

I've asked this in SO but maybe here is more suitable to ask. I'm installed GnuPG via Pecl. Generate pub/priv keys etc.. I have in php.ini extension=gnupg.so When I try to run simple code I've got ...
1
vote
1answer
656 views

how to trigger gpg agent refresh password?

We use StackExchange blackbox as well as Hiera-eyaml-gpg to encrypt files in our Git repo using GPG keys. I configured Git to decrypt files using Textconv configuration, so it automatically decrypts ...
0
votes
0answers
63 views

Trying to load posted public key from http://pgp.mit.edu:11371/ after loading it there

So, I run pgp --dry-run --import test.asc on the public key I gave to the site and then I look it up with that key that it gives back and it says not found. How to do this properly such that I can ...