gpg-ssh-yubikey.md

🔥 This is a work in progress moving a bunch of notes to one place so I don't have to do this from memory ever again...

Versions Tested

# Local (MacOS Catalina)
gpg (GnuPG) 2.2.30 
OpenSSH_8.1p1, LibreSSL 2.7.3

# Remote (Ubuntu 20.04 LTS)
gpg (GnuPG) 2.2.19 
OpenSSH_8.2p1 Ubuntu-4ubuntu0.3, OpenSSL 1.1.1f  31 Mar 2020

Prerequisites

1. Install GPG.

   For MacOS

   brew install [email protected] pinentry-mac
   brew link [email protected]
   

   For Ubuntu 20.04 LTS

   apt-get update
   apt-get install gnupg
   

Configure GPG (local)

1. Add use-agent to `~/.gnupg/gpg.conf:

   echo "use-agent" > ~/.gnupg/gpg.conf
   

2. Add the following to ~/.gnupg/gpg-agent.conf:

   allow-loopback-pinentry
   enable-ssh-support
   default-cache-ttl 14400
   max-cache-ttl 86400
   pinentry-program /usr/local/bin/pinentry-mac
   

3. Configure gpg-agent to start on login by adding the following to ~/.bash_profile:

   [ -f ~/.gpg-agent-info ] && source ~/.gpg-agent-info
   if [ -S "${GPG_AGENT_INFO%%:*}" ]; then
      export GPG_AGENT_INFO
   else
      eval $( gpg-agent --daemon --write-env-file ~/.gpg-agent-info )
   fi
   

4. Kill any running agents:

   sudo killall gpg-agent
   

5. Restart terminal to reload ~/.bash_profile and start the gpg-agent

Configure GPG (remote)

1. Add the following to `~/.gnupg/gpg.conf:

   use-agent
   default-key {PUBLIC_KEY}
   

2. Initialize GPG

   gpg --list-keys
   

Export public key from local machine to remote machine

On the local machine, run the following:

gpg --export -a {PUBLIC_KEY} | ssh {REMOTE_HOST} 'gpg --import -'

Fetch your USERNAME and REMOTE_UID

On the remote machine, run the following:

whoami
id -u

This will return your USERNAME and REMOTE_UID for future use.

Configure SSH (local)

1. Add the following to ~/.ssh/config (replace text marked {...} with your own values):

   Host {REMOTE_HOST}
       HostName {REMOTE_HOST}
       ForwardAgent yes
       User {USERNAME}
       RemoteForward /run/user/{REMOTE_UID}/gnupg/S.gpg-agent /Users/{USERNAME}/.gnupg/S.gpg-agent
   

Configure SSH (remote)

1. Add the following to /etc/ssh/sshd_config:

   StreamLocalBindUnlink yes
   

2. Restart sshd:

   systemctl restart sshd
   

Verification

1. SSH to the remote host and verify that:

   • The public keyring is imported and located at ~/.gnupg/pubring.kbx
   • The S.gpg-agent socket is located at ~/.gnupg/S.gpg-agent

2. Verify output of gpg --card-status:

   $ gpg --card-status
   Reader ...........: Yubico YubiKey OTP FIDO CCID
   <snip>
   

3. Encrypt a file on the local machine, copy it to the remote, and attempt to decrypt on the remote:

   $ echo "yubikey" | gpg --encrypt -r [email protected] > secret.enc
   
   $ scp secret.enc dev.vm:~
   
   $ ssh dev.vm 'gpg --decrypt secret.enc'
   yubikey
   gpg: encrypted with 4096-bit RSA key, ID B7C85D2A5FBBAC05, created 2020-01-13
         "Dustin Wheeler <[email protected]>"
   

Will be incorporating the following into instructions above:

• https://kharysharpe.medium.com/automatic-local-domains-setting-up-dnsmasq-for-macos-high-sierra-using-homebrew-caf767157e43