SSH – Pinentry Fails with GPG-Agent and SSH

Turns out this one was incredibly simple. Instead of using that script, I simply removed the "--agents" option from my old keychain launch script (guide here).

This causes the Keychain program to seek out both ssh-agent AND gpg-agent files. Now my encryption system does work quite seamlessly, even while relying on both types of agents.

I know this is a very old question. However, there are two answers to your question.

Getting GPG working with SSH.

You've done the first step, enabling-ssh-support in your gpg-agent.conf

But, you haven't supplied any PGP keys to use. In order to use PGP keys with ssh, you've got to export the public key in ssh format and add that to your remote host's ~/.ssh/authorized_keys file. Then add the keygrip of the private key to the file ~/.gnupg/sshcontrol.

To export a PGP public key as ssh:

$gpg -a --export-ssh-key [keyid]

To view a PGP keygrip: $gpg --with-keygrip --list-secret-keys [keyid]

I usually create a suitable subkey for use with SSH. If you are using GPG 2.2.1 then you can even use ED25519.

$gpg --expert --edit-key [keyid]
    gpg> addkey
        Option 11 for ECC
        Option A to add authentication
        Option 1 for Curve 25519
        Expire never
        Create yes
    gpg> save

Then export just the authentication subkey:

$gpg -a --export-ssh-key [auth subkeyid]!

The exclamation point selects just the indicated subkey.

You will also need to make sure the environment variables are set in your ~/.bashrc ... If you are running an Xwindow client, this is usually done for you via /etc//X11/Xsession.d/90gpg-agent with the following bash script:

agent_sock=$(gpgconf --list-dirs agent-socket)
export GPG_AGENT_INFO=${agent_sock}:0:1
if [ -n "$(gpgconf --list-options gpg-agent | \
      awk -F: '/^enable-ssh-support:/{ print $10 }')" ]; then
    export SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket)
fi

Once you've ensured the environment variables are set, any keygrips added to the ~/.gnupg/sshcontrol file will appear as authentication keys in the ssh-agent when you list the available identities:

$ssh-add -l

Note, you can change the shown hash via the -E option to show MD5 or SHA256.

Configuring SSH to use certificates

This is a rather complex question. Red Hat has a detailed walkthrough here:

Redhat SSH CA Tutorial

End

It's unclear if it's possible to use PGP keys as the SSH CA keys. I haven't tried that myself. However, I do use PGP keys on the client side. I find that it makes life very easy and is less cumbersome to manage SSH identities than using ssh-genkey generated keys.