无法将gpg-agent用作ssh代理

Question

我一直在尝试将gpg-agent作为ssh代理运行，但没有成功。我正在运行Linux Mint（Sarah）的KDE版本。

首先，我在/etc/X11/Xsession.options中禁用了内置的ssh代理：

# $Id: Xsession.options 189 2005-06-11 00:04:27Z branden $
#
# configuration options for /etc/X11/Xsession
# See Xsession.options(5) for an explanation of the available options.
allow-failsafe
allow-user-resources
allow-user-xsession
#use-ssh-agent
use-session-dbus

然后，我在gpg-agent中启用了ssh-agent支持：

> $ cat ~/.gnupg/gpg-agent.conf                                                                                                                            
enable-ssh-support

此时，我重新启动了计算机，并检查了我的环境变量：

> $ echo $GPG_AGENT_INFO                                                                                                                                   
/home/jeroen/.gnupg/S.gpg-agent:0:1

> $ echo $SSH_AUTH_SOCK                                                                                                                                    
/home/jeroen/.gnupg/S.gpg-agent.ssh

为确保没有其他代理正在运行：

> $ ps aux | grep agent                                                                                                                                    
jeroen    5072  0.0  0.0 282604   764 ?        Ss   Nov24   0:15 /usr/bin/gpg-agent --daemon
jeroen    5265  0.0  0.1 697044 29032 ?        Sl   Nov24   0:01 /usr/lib/x86_64-linux-gnu/libexec/polkit-kde-authentication-agent-1
jeroen    9574  0.0  0.0 130292  1016 pts/6    S+   12:15   0:00 grep --color=auto --exclude-dir=.bzr --exclude-dir=CVS --exclude-dir=.git --exclude-dir=.hg --exclude-dir=.svn agent

目前为止，一切看起来都很好。那么让我们来看一下我的GPG密钥：

pub   rsa2048/03AB1CB5 2015-06-12 [SC]
uid         [ultimate] Jeroen Jacobs <[e-mail]>
uid         [ultimate] Jeroen Jacobs <[e-mail]>
sub   rsa2048/014F9774 2015-06-12 [E]
sub   rsa2048/0FEF1A6F 2017-11-23 [A]

您可以看到，存在一个认证子密钥。那么 gpg-agent 一定会接收到这个信息了，对吗？

ssh-add -l                                                                                                                                             
The agent has no identities.

嗯，它不行...我已经重新启动了我的电脑，但没有任何区别。我几乎阅读了关于这个主题的所有教程，我认为我按照书本上的步骤做了一切，但我无法让它工作。

以防万一，您需要知道gpg2和gpg-agent的版本：

> $ gpg2 --version                                                                                                                                         
gpg (GnuPG) 2.1.11
libgcrypt 1.6.5
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: ~/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
        CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

> $ gpg-agent --version                                                                                                                                    
gpg-agent (GnuPG) 2.1.11
libgcrypt 1.6.5
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

- Jeroen Jacobs

---

SSH代理在GPG中是否支持提取身份验证子密钥？我认为它只是标准SSH代理的替代品，您需要使用ssh-add手动添加密钥。 - larsks

Answer 1

将您的认证子密钥的keygrip添加到~/.gnupg/sshcontrol文件中。

附加keygrip

gpg -K --with-keygrip是列出所有带有其keygrip的秘密密钥的命令。

- Ron