Linux – force gpg-agent to forget password

enigmailgnupglinux

I am using gpg-agent 2.0.17 with gpg 1.4.11 on ubuntu 12.04 and the Enigmail Addon for Thunderbird. When opening an encrypted email, Enigmail invokes gpg-agent with the associated pinentry program and asks for the password. I then have the option to set the lifetime for the cached password, usually set to end of the session.

Since I rarely shutdown or logout of my session, I would like to force gpg-agent to forget all cached passwords upon locking the session. I've searched for a way to do so and the man-page of gpg-agent states, that a -SIGHUP will flush all passwords – however, contrary to the manpage, the cached passwords are not forgotten.

Any ideas on how to force gpg-agent to forget the passwords?

Best Answer

gpgconf --reload gpg-agent is one way to force the agent to forget passwords it has cached in memory. Currently (gpg 2.0-2.1) this is [almost] equivalent to pkill -HUP gpg-agent. I say "almost equivalent" since you could, in theory, have more than one agent running and the pkill will try to deliver SIGHUP to all of them.

Related Solutions

Gpg with gpg-agent never asks for passphrase

This happens when gpg-agent doesn't know which TTY to prompt on, which is happening here because you are redirecting stdin.

You can put export GPG_TTY=$(tty) in your ~/.bashrc to setup the TTY for each login shell.

The docs on gpg-agent has more details.

Using systemd to start gpg-agent

The gpg-agent command starts a daemon, but programs that use it expect certain environment variables (GPG_AGENT_INFO and GPG_TTY) to be set so they know how to communicate with the agent. You have to somehow propagate these from the service script to your shells. The gpg-agent MAN page contains a snippet that starts the daemon and writes a shell code fragment to a file in the user's home

gpg-agent --daemon --write-env-file "${HOME}/.gpg-agent-info"

You can put this line into as shell script and call it from your service file

[Service]
Type=forking
ExecStart=script-file.sh
<...>

The .gpg-agent-info file has to be sourced from every shell. The MAN page recommends

if [ -f "${HOME}/.gpg-agent-info" ]; then
  . "${HOME}/.gpg-agent-info"
  export GPG_AGENT_INFO
fi

GPG_TTY=$(tty)
export GPG_TTY

in your .profile file to do this. Information on how to write systemd service files can be found in the systemd.service MAN page.

Best Answer

Related Solutions

Gpg with gpg-agent never asks for passphrase

Using systemd to start gpg-agent

Related Question