From 3572d911b5c937ff57b5d18110377246b1d44906 Mon Sep 17 00:00:00 2001 From: drduh Date: Mon, 26 Dec 2022 10:50:22 -0800 Subject: [PATCH 1/2] Update admin command order, plink quotes and keytocard note --- README.md | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index ee25016..594e196 100644 --- a/README.md +++ b/README.md @@ -1303,7 +1303,7 @@ $ sudo cp -avi $GNUPGHOME /mnt/encrypted-storage/ $ sudo cp onerng_3.6-1_all.deb /mnt/encrypted-storage/ ``` -Keep the backup mounted if you plan on setting up two or more keys as `keytocard` **will [delete](https://lists.gnupg.org/pipermail/gnupg-users/2016-July/056353.html) the local copy** on save. +If you plan on setting up multiple keys, keep the backup mounted or remember to terminate the gpg process before [saving](https://lists.gnupg.org/pipermail/gnupg-users/2016-July/056353.html). Unmount, close and disconnect the encrypted volume: @@ -1313,7 +1313,6 @@ $ sudo umount /mnt/encrypted-storage/ $ sudo cryptsetup luksClose secret ``` - **OpenBSD** Attach a USB disk and determine its label: @@ -1386,7 +1385,7 @@ $ doas mount /dev/sd3i /mnt/encrypted-storage $ doas cp -avi $GNUPGHOME /mnt/encrypted-storage ``` -Keep the backup mounted if you plan on setting up two or more keys as `keytocard` **will [delete](https://lists.gnupg.org/pipermail/gnupg-users/2016-July/056353.html) the local copy** on save. +If you plan on setting up multiple keys, keep the backup mounted or remember to terminate the gpg process before [saving](https://lists.gnupg.org/pipermail/gnupg-users/2016-July/056353.html). Otherwise, unmount and disconnect the encrypted volume: @@ -1513,6 +1512,13 @@ Authentication key: [none] General key info..: [none] ``` +Enter administrative mode: + +```console +gpg/card> admin +Admin commands are allowed +``` + **Note** If the card is locked, see [Reset](#reset). **Windows** @@ -1523,9 +1529,6 @@ Use the [YubiKey Manager](https://developers.yubico.com/yubikey-manager) applica Key Derived Function (KDF) enables YubiKey to store the hash of PIN, preventing the PIN from being passed as plain text. Note that this requires a relatively new version of GnuPG to work, and may not be compatible with other GPG clients (notably mobile clients). These incompatible clients will be unable to use the YubiKey GPG functions as the PIN will always be rejected. If you are not sure you will only be using your YubiKey on supported platforms, it may be better to skip this step. ```console -gpg/card> admin -Admin commands are allowed - gpg/card> kdf-setup ``` @@ -2470,10 +2473,13 @@ To authenticate: Run the following commands: - > git config --global core.sshcommand 'plink -agent' - > git config --global gpg.program 'C:\Program Files (x86)\GnuPG\bin\gpg.exe' +```console +git config --global core.sshcommand "plink -agent" + +git config --global gpg.program 'C:\Program Files (x86)\GnuPG\bin\gpg.exe' +``` -You can then change the repository url to `git@github.com:USERNAME/repository` and any authenticated commands will be authorized by YubiKey. +You can then change the repository URL to `git@github.com:USERNAME/repository` and any authenticated commands will be authorized by YubiKey. **Note** If you encounter the error `gpg: signing failed: No secret key` - run `gpg --card-status` with YubiKey plugged in and try the git command again. From 90a3ebc5468d73b601a4aa9cb7466c6c421fa576 Mon Sep 17 00:00:00 2001 From: drduh Date: Mon, 26 Dec 2022 10:54:14 -0800 Subject: [PATCH 2/2] safe quote remove-keygrips.sh --- README.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 594e196..dd8b0d5 100644 --- a/README.md +++ b/README.md @@ -1303,7 +1303,7 @@ $ sudo cp -avi $GNUPGHOME /mnt/encrypted-storage/ $ sudo cp onerng_3.6-1_all.deb /mnt/encrypted-storage/ ``` -If you plan on setting up multiple keys, keep the backup mounted or remember to terminate the gpg process before [saving](https://lists.gnupg.org/pipermail/gnupg-users/2016-July/056353.html). +**Note** If you plan on setting up multiple keys, keep the backup mounted or remember to terminate the gpg process before [saving](https://lists.gnupg.org/pipermail/gnupg-users/2016-July/056353.html). Unmount, close and disconnect the encrypted volume: @@ -1385,7 +1385,7 @@ $ doas mount /dev/sd3i /mnt/encrypted-storage $ doas cp -avi $GNUPGHOME /mnt/encrypted-storage ``` -If you plan on setting up multiple keys, keep the backup mounted or remember to terminate the gpg process before [saving](https://lists.gnupg.org/pipermail/gnupg-users/2016-July/056353.html). +**Note** If you plan on setting up multiple keys, keep the backup mounted or remember to terminate the gpg process before [saving](https://lists.gnupg.org/pipermail/gnupg-users/2016-July/056353.html). Otherwise, unmount and disconnect the encrypted volume: @@ -2753,8 +2753,8 @@ Alternatively, use a script to delete the GnuPG shadowed key, where the card ser ```console $ cat >> ~/scripts/remove-keygrips.sh <&2; exit 1; } +KEYGRIPS=$(gpg --with-keygrip --list-secret-keys "$@" | awk '/Keygrip/ { print $3 }') for keygrip in $KEYGRIPS do rm "$HOME/.gnupg/private-keys-v1.d/$keygrip.key" 2> /dev/null