Forward GnuPG agent from macOS to Linux
Run gpg once as your to create the directory structure
gpg --list-keys
Disable gpg-agent startup via systemd by masking the sockets:
sudo systemctl --global mask gpg-agent.service gpg-agent.socket gpg-agent-ssh.socket gpg-agent-extra.socket gpg-agent-browser.socket
killall gpg-agent
If you want to maintain the auto start and stop of gpg-agent on the host you need to do the following:
Edit /etc/ssh/sshd_config
to include the line:
StreamLocalBindUnlink yes
Add this line to your user's $HOME/.bashrc
:
gpgconf --create-socketdir
Add this line to the file: $HOME/.gnupg/gpg-agent.conf
extra-socket $HOME/.gnupg/S.gpg-agent.extra
Reload your current gpg-agent:
gpg-connect-agent reloadagent /bye
Edit $HOME/.ssh/config to forward the gpg-agent socket. Note this doesn't support ssh config variables so you need to use the full path.
Forwarding from macOS to Linux:
host gpgtunnel
hostname remotehost.example.com
User yourusername
RemoteForward /home/<user>/.gnupg/S.gpg-agent /Users/<user>/.gnupg/S.gpg-agent.extra
Forwarding from macOS to systemd based Linux, use id -u
on the remote system to find your UID:
host gpgtunnel
hostname systemd-host.example.com
User yourusername
RemoteForward /run/user/<remote UID>/gnupg/S.gpg-agent /Users/<user>/.gnupg/S.gpg-agent.extra
Copy the public half of your keys to the remote machine:
scp $HOME/.gnupg/pubring.gpg gpgtunnel:$HOME/.gnupg/
You only have to copy the public half of the private key you are going to use, if you have that handy you can just copy it over and then use gpg --import mypublickey.pub
Now test that the gpg-agent works on the local machine:
echo "test" | gpg --encrypt -r $MYKEYID
echo "test" | gpg --encrypt -r $MYKEYID > output
gpg --decrypt output
Now ssh to remote machine
scp output gpgtunnel:
ssh gpgtunnel
gpg --decrypt output
The gpg-agent should be able to use your authentication on the local machine.
Worked between 2
aarch64
Raspberry PIs runningDebian GNU/Linux 12 (bookworm)
with the following caveats:laptop
.gpg-agent
(key-host
) was accessed via SSH with secure display forwardingssh -Y
fromlaptop
git-dev-host
was accessed using ssh fromkey-host
.pinentry-fltk
as defaultpinentry-curses
doesn't mix well with remote execution.key-host
andgit-dev-host
were restarted to get clean startup state.The use case was to sign git commits on
git-dev-host
using the keys inkey-host
but accessed from thelaptop
.I started with https://wiki.archlinux.org/title/GnuPG and used this gist when troubleshooting my issues.