Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #175110 > unrolled thread
| Started by | kjonca@poczta.onet.pl (Kamil Jońca) |
|---|---|
| First post | 2016-11-27 10:40 +0100 |
| Last post | 2016-11-28 14:20 +0100 |
| Articles | 3 — 2 participants |
Back to article view | Back to linux.debian.user
sudo + gpg - howto? kjonca@poczta.onet.pl (Kamil Jońca) - 2016-11-27 10:40 +0100
Re: sudo + gpg - howto? Michael Luecke <mluecke@mailbox.org> - 2016-11-27 12:40 +0100
Re: sudo + gpg - howto? kjonca@poczta.onet.pl (Kamil Jońca) - 2016-11-28 14:20 +0100
| From | kjonca@poczta.onet.pl (Kamil Jońca) |
|---|---|
| Date | 2016-11-27 10:40 +0100 |
| Subject | sudo + gpg - howto? |
| Message-ID | <sI46d-2vH-3@gated-at.bofh.it> |
I have gpg-encrypted backups made by amanda (gnutar). Decrypting was done by call gpg with --passphrase-fd option. Recently I have to see some backup contensts and as usual I wrote: --8<---------------cut here---------------start------------->8--- sudo amrecover ... --8<---------------cut here---------------end--------------->8--- but without success. Some investigation suggests that gpg-agent started as 'backup' user 1. completely ignores passphrase-fd/passphrase-file option. 2. cannot run pinentry (my guess is that tty is owned by user kjonca and pinentry should be as user backup) So my questions are: 1. is it possible to use passphrase-fd/passphrase-file options? 2. if not, how can I configure gpg/gpgagen/sudo/whatever in order to enter passphrase as sudo target user? KJ -- http://stopstopnop.pl/stop_stopnop.pl_o_nas.html można nie mieć nawet żadnego sensownego argumentu, a dzięki odpowiedniej gestykulacji stworzyć poczucie wiarygodności. Puls Biznesu
[toc] | [next] | [standalone]
| From | Michael Luecke <mluecke@mailbox.org> |
|---|---|
| Date | 2016-11-27 12:40 +0100 |
| Message-ID | <sI5Yl-3Hx-25@gated-at.bofh.it> |
| In reply to | #175110 |
On 11/27/2016 10:10 AM, Kamil Jońca wrote: > 2. cannot run pinentry (my guess is that tty is owned by user kjonca and > pinentry should be as user backup) That's the problem. The owner of ttyX must match with the user for which pinentry is running. You could change the permissions of tty to the backup user with # chown backup /dev/ttyX > So my questions are: > 1. is it possible to use passphrase-fd/passphrase-file options? > 2. if not, how can I configure gpg/gpgagen/sudo/whatever in order to > enter passphrase as sudo target user? You could also try putting the option "allow-loopback-pinentry" to ~/.gnupg/gpg-agent.conf and restarting the agent. Then you could start gpg with '--pinentry-mode loopback' or put "pinentry-mode loopback" to ~/.gnupg/gpg.conf. That worked for me with GnuPG 2 some time ago when I had a similar problem with duplicity. Best Regards, Michael
[toc] | [prev] | [next] | [standalone]
| From | kjonca@poczta.onet.pl (Kamil Jońca) |
|---|---|
| Date | 2016-11-28 14:20 +0100 |
| Message-ID | <sIu0G-2yY-23@gated-at.bofh.it> |
| In reply to | #175112 |
Michael Luecke <mluecke@mailbox.org> writes: [...] > > > You could also try putting the option "allow-loopback-pinentry" to > ~/.gnupg/gpg-agent.conf and restarting the agent. > > Then you could start gpg with '--pinentry-mode loopback' or put > "pinentry-mode loopback" to ~/.gnupg/gpg.conf. Hm. After doing that gpg was able to read passphrase from file. Succes. But this behaviour is strange for me. Thanks. KJ -- http://stopstopnop.pl/stop_stopnop.pl_o_nas.html Get Revenge! Live long enough to be a problem for your children!
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.user
csiph-web