From f0a0801a51b3511bb210a2468434c8fd8d8dc4a4 Mon Sep 17 00:00:00 2001 From: drduh Date: Sun, 10 Mar 2024 14:20:00 -0700 Subject: [PATCH 1/2] Workaround for Authenticate key issue --- README.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 1fc8001..c268cee 100644 --- a/README.md +++ b/README.md @@ -552,15 +552,13 @@ pub rsa4096/0xF0F2CFEB04341FB5 2024-01-01 [C] uid YubiKey User ``` -Copy the Certify key identifier beginning with `0x` from the output and export it as a [variable](https://stackoverflow.com/questions/1158091/defining-a-variable-with-or-without-export/1158231#1158231) (`KEYID`): +Export the Certify key identifier beginning with `0x` as `KEYID` with the following command or by pasting the value manually: ```console -export KEYID=0xF0F2CFEB04341FB5 +export KEYID=$(gpg -K | grep -Po "(0x\w+)") ``` -**Optional** Existing keys may be used to sign new ones to prove ownership. - -Export the existing key to the working keyring and sign the new key: +**Optional** Existing keys may be used to sign new ones to prove ownership. Export the existing key to the working keyring and sign the new key: ```console gpg --export-secret-keys --armor --output /tmp/new.sec @@ -676,6 +674,8 @@ Generate an Authentication key by typing `addkey` then `8` to select the `(8) RS Toggle the required capabilities with `S`, `E` and `A` until **Authenticate** is the only allowed action: +**Note** Newer versions of GnuPG may set a Restricted flag on the Authenticate key (see [issue 421](https://github.com/drduh/YubiKey-Guide/issues/421) - set the **Authenticate** action with `=A` instead. + ```console gpg> addkey Please select what kind of key you want: @@ -812,7 +812,7 @@ Do you really want to set this key to ultimate trust? (y/N) y gpg> save ``` -By default, the latest identity added will be the primary user ID. Select `uid 2` or equivalent and `primary` to change it. +By default, the latest identity added will be the primary user ID. To change it, select `uid 2` or equivalent and `primary` # Verify @@ -2642,7 +2642,7 @@ To reset YubiKey from the Certify key backup (such as the one on encrypted porta - If you still receive the error, `sign_and_send_pubkey: signing failed: agent refused operation` - it is a [known issue](https://bbs.archlinux.org/viewtopic.php?id=274571) that openssh 8.9p1 and higher has issues with YubiKey. Adding `KexAlgorithms -sntrup761x25519-sha512@openssh.com` to `/etc/ssh/ssh_config` often resolves the issue. -- If you receive the error, `The agent has no identities` from `ssh-add -L`, make sure you have installed and started `scdaemon`. +- If you receive the error, `The agent has no identities` from `ssh-add -L`, make sure you have installed and started `scdaemon` - If you receive the error, `Error connecting to agent: No such file or directory` from `ssh-add -L`, the UNIX file socket that the agent uses for communication with other processes may not be set up correctly. On Debian, try `export SSH_AUTH_SOCK="/run/user/$UID/gnupg/S.gpg-agent.ssh"`. Also see that `gpgconf --list-dirs agent-ssh-socket` is returning single path, to existing `S.gpg-agent.ssh` socket. @@ -2654,7 +2654,7 @@ To reset YubiKey from the Certify key backup (such as the one on encrypted porta - If you receive the error, `Please insert the card with serial number` see [Using Multiple Keys](#using-multiple-keys). -- If you receive the error, `There is no assurance this key belongs to the named user` or `encryption failed: Unusable public key` use `gpg --edit-key` to set `trust` to `5 = I trust ultimately`. +- If you receive the error, `There is no assurance this key belongs to the named user` or `encryption failed: Unusable public key` or `No public key` use `gpg --edit-key` to set `trust` to `5 = I trust ultimately` - If, when you try the above command, you get the error `Need the secret key to do this` - specify trust for the key in `~/.gnupg/gpg.conf` by using the `trust-key [key ID]` directive. From c1b556c7c5a3b7c5f5274302a467c17e295135e1 Mon Sep 17 00:00:00 2001 From: drduh Date: Sun, 10 Mar 2024 14:22:32 -0700 Subject: [PATCH 2/2] formatting fix --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index c268cee..0a9da27 100644 --- a/README.md +++ b/README.md @@ -672,9 +672,9 @@ ssb rsa4096/0x30CBE8C4B085B9F7 Generate an Authentication key by typing `addkey` then `8` to select the `(8) RSA (set your own capabilities)` option. -Toggle the required capabilities with `S`, `E` and `A` until **Authenticate** is the only allowed action: +**Note** Newer versions of GnuPG may set a Restricted flag on the Authenticate key (see [issue 421](https://github.com/drduh/YubiKey-Guide/issues/421)) - set the **Authenticate** action with `=A` instead. -**Note** Newer versions of GnuPG may set a Restricted flag on the Authenticate key (see [issue 421](https://github.com/drduh/YubiKey-Guide/issues/421) - set the **Authenticate** action with `=A` instead. +Toggle the required capabilities with `S`, `E` and `A` until **Authenticate** is the only allowed action: ```console gpg> addkey