Yrurtj

I'm using openssh7.5p1 and gnupg 2.1.21 on arch linux (these are the default versions that come with arch). I would like to use gpg-agent as an ssh agent. I put the following in my ~/.gnupg/gpg-agent.conf:

pinentry-program /usr/bin/pinentry-qt

enable-ssh-support

Arch automatically starts a gpg-agent from systemd, so I set

export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/gnupg/S.gpg-agent.ssh"

When I run ssh-add -l, it reports no identities and ps reports a gpg-agent --supervised process as I would expect.

Unfortunately, when I run ssh-add, no matter what the key type, it doesn't work. Here is an example of how I tried dsa:

$ ssh-keygen -f testkey -t dsa -N ''

Generating public/private dsa key pair.

Your identification has been saved in testkey.

Your public key has been saved in testkey.pub.

$ ssh-add testkey

Could not add identity "testkey": agent refused operation

All other gpg functions work properly (encrypting/decrypting/signing). Also, the keys I generate work fine if I use them directly with ssh, and they work properly if I run the ssh-agent that came with openssh.

The documentation says that ssh-add should add keys to ~/.gnupg/sshcontrol, but obviously nothing is happening.

My question: What's the easiest way to load a key generated by openssh's ssh-keygen into gpg-agent, and can someone please cut and paste a terminal session showing how this works?

The answer was apparently to run:

echo UPDATESTARTUPTTY | gpg-connect-agent

I have no idea why the pinentry program worked fine for other uses such as decrypting files, but didn't work for ssh-add.

While this now works, it also makes a copy of the ssh private key that doesn't show up under gpg -Kv, and furthermore doesn't seem to allow you to change the passphrase on your private key (since you can't edit it with --edit-key). Basically I'm pretty unhappy with the way gpg-agent provides low visibility into where your secrets are being copied. If you hit this question because you hoped gpg-agent might be a better alternative to ssh-agent, then I'd encourage you to stick to ssh-agent instead of trying out my answer. The main reason to prefer gpg-agent is if you need to for smart-card use.

In my case, the problem was the pinentry program used. I was using pinentry-emacs. It seems it doesn't handle the dual text field entry window prompt that ssh-add triggers when used with gpg-agent.

Removing pinentry-emacs and installing the GTK pinentry solved the problem here.

I hope this can help someone! The error message sure didn't give me any clue.