Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improving Agent Forwarding section #88

Merged
merged 5 commits into from
Jan 18, 2019
Merged

Improving Agent Forwarding section #88

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
547e977
Merge pull request #2 from drduh/master
Wheest Jan 7, 2019
7eed0cc
Improvements to Agent Forwarding section, following feedback in:
Wheest Jan 7, 2019
b44f613
Further amendments to Agent Forwarding
Wheest Jan 7, 2019
c28b333
Moved Agent Forwarding section to before the WSL one
Wheest Jan 7, 2019
ee71716
Added pull request suggestions
Jan 12, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
73 changes: 54 additions & 19 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1356,6 +1356,59 @@ $ ssh-add -E md5 -l

When using the key `pinentry` will be invoked to request the key's passphrase. The passphrase will be cached for up to 10 minutes idle time between uses, to a maximum of 2 hours.

## Remote Machines (agent forwarding)
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you add this to TOC?


If you want to use your YubiKey to sign a git commit on a remote machine, or ssh through another layer, then this is possible using "Agent Forwarding". This section should help you setup GPG and SSH agent forwarding.

To do this, you need to already have shell access to your remote machime, and your YubiKey setup on your host machine.
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

machine*


- First, on your local host machine run:

```
$ gpgconf --list-dirs agent-extra-socket
```

This should return a path to your agent-extra-socket, which should look similar to `/run/user/1000/gnupg/S.gpg-agent.extra`, though on older linux distros (and macs), it may be `/home/<user>/.gnupg/S/gpg-agent.extra`.

- Next, find the agent socket on your **remote** machine:

```
$ gpgconf --list-dirs agent-socket
```

This should return a path such as `/run/user/1000/gnupg/S.gpg-agent`.

- On your remote machine, edit the file `/etc/ssh/sshd_config`, so that option `StreamLocalBindUnlink` is set to `StreamLocalBindUnlink yes`

- _(optional)_If you do not have root access to the remote machine to edit `/etc/ssh/sshd_config`, you will need to remove the socket on the remote machine before forwarding works. For example, `rm /run/user/1000/gnupg/S.gpg-agent`. Further information can be found on the [AgentForwarding GNUPG wiki page](https://wiki.gnupg.org/AgentForwarding).
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's use **Optional** format.



- Now you need to import your public keys to the remote machine. This can be done by fetching from a keyserver. Here we show how to copy your public keyring. On your local machine, you need to copy your public keyring to your remote machine

```
$ scp .gnupg/pubring.kbx remote:~/.gnupg/
```

- Finally, to enable agent forwarding for a given machine, add the following to your local machine's ssh config file `~/.ssh/config` (your agent sockets may be different):

```
Host
Hostname your-domain
ForwardAgent yes
Wheest marked this conversation as resolved.
Show resolved Hide resolved
RemoteForward /run/user/1000/gnupg/S.gpg-agent /run/user/1000/gnupg/S.gpg-agent.extra
# RemoteForward [remote socket] [local socket]
```

You should then be able to use your YubiKey as if it were connected to the remote machine.

If you're still having problems, it may be necessary to edit your `gpg-agent.conf` file on both your remote and local machines to add the following information.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we have any confirmation or reference that this should be done on both? I'm pretty sure that this is not required on the remote machine, and may be misleading (in the sense that it implies you have the gpg-agent running on both platforms, which I think can actually create a problem, some instructions say to kill the remote gpg-agent to make sure it's not running but using the forwarded agent from the socket)...

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This configuration still wasn't enough for me. I had to also do gpg --export-ssh-key > ~/.ssh/id_rsa_yubikey, chown 600 ~/.ssh/id_rsa_yubikey and add IdentityFile ~/.ssh/id_rsa_yubikey before I could ssh using only my yubikey public ssh key. Otherwise it would only work if I also had some other private ssh key. The documentation suggests this isn't necessary, and this guide has suggested that you can use the public key as the IdentityFile, but that always throws a format error, as you might expect.

We may also need to note that the public ssh key (from ssh-add -L needs to be added to remote ~/.known_hosts.


```
enable-ssh-support
pinentry-program /usr/bin/pinentry-curses
extra-socket /run/user/1000/gnupg/S.gpg-agent.extra
```

## GitHub

You can use YubiKey to sign GitHub commits and tags. It can also be used for GitHub SSH authentication, allowing you to push, pull, and commit without a password.
Expand Down Expand Up @@ -1465,24 +1518,6 @@ StreamLocalBindUnlink yes

**Note** Agent forwarding may be chained through multiple hosts - just follow the same [protocol](#remote-host-configuration) to configure each host.

# Remote Machines (agent forwarding)

If you want to use your YubiKey to sign a git commit on a remote machine, or ssh through another layer, then this is possible using "Agent Forwarding". Assuming that you have your YubiKey setup on your host machine.

To enable agent forwarding, ssh using the `-A` flag:

```
$ ssh -A user@remote
```

Or add the following to your ssh config file:

```
Host remote
ForwardAgent yes
```

You should then be able to use your YubiKey as if it were connected to the remote machine.

# Troubleshooting

Expand Down Expand Up @@ -1538,4 +1573,4 @@ You should then be able to use your YubiKey as if it were connected to the remot
* https://www.esev.com/blog/post/2015-01-pgp-ssh-key-on-yubikey-neo/
* https://www.hanselman.com/blog/HowToSetupSignedGitCommitsWithAYubiKeyNEOAndGPGAndKeybaseOnWindows.aspx
* https://www.void.gr/kargig/blog/2013/12/02/creating-a-new-gpg-key-with-subkeys/

* https://mlohr.com/gpg-agent-forwarding/