Moved Agent Forwarding section to before the WSL one
Wheest
parent
b44f6131ef
commit
c28b33372c
101
README.md
101
README.md
|
|
@ -1356,6 +1356,57 @@ $ ssh-add -E md5 -l
|
|||
|
||||
When using the key `pinentry` will be invoked to request the key's passphrase. The passphrase will be cached for up to 10 minutes idle time between uses, to a maximum of 2 hours.
|
||||
|
||||
## Remote Machines (agent forwarding)
|
||||
|
||||
If you want to use your YubiKey to sign a git commit on a remote machine, or ssh through another layer, then this is possible using "Agent Forwarding". To do this, you need to already have shell access to your remote machime, and your YubiKey setup on your host machine.
|
||||
|
||||
- First, on your host machine run:
|
||||
|
||||
```
|
||||
$ gpgconf --list-dirs agent-extra-socket
|
||||
```
|
||||
|
||||
This should return a path to your agent-extra-socket, which should look similar to `/run/user/1000/gnupg/S.gpg-agent.extra`.
|
||||
|
||||
- Next, find the agent socket on your **remote** machine:
|
||||
|
||||
```
|
||||
$ gpgconf --list-dirs agent-socket
|
||||
```
|
||||
|
||||
This should return a path such as `/run/user/1000/gnupg/S.gpg-agent`.
|
||||
|
||||
- On your remote machine, edit the file `/etc/ssh/sshd_config`, so that option `StreamLocalBindUnlink` is set to `StreamLocalBindUnlink yes`
|
||||
|
||||
- _(optional)_If you do not have root access to the remote machine to edit `/etc/ssh/sshd_config`, you will need to remove the socket on the remote machine before forwarding works. For example, `rm /run/user/1000/gnupg/S.gpg-agent`. Further information can be found on the [AgentForwarding GNUPG wiki page](https://wiki.gnupg.org/AgentForwarding).
|
||||
|
||||
- On your local machine, you need to copy your public keyring to your remote machine
|
||||
|
||||
```
|
||||
$ scp .gnupg/pubring.kbx remote:~/.gnupg/
|
||||
```
|
||||
|
||||
- Finally, to enable agent forwarding for a given machine, add the following to your ssh config file (your agent sockets may be different):
|
||||
|
||||
```
|
||||
Host remote
|
||||
ForwardAgent yes
|
||||
RemoteForward /run/user/1000/gnupg/S.gpg-agent /run/user/1000/gnupg/S.gpg-agent.extra
|
||||
# RemoteForward [remote socket] [local socket]
|
||||
```
|
||||
|
||||
You should then be able to use your YubiKey as if it were connected to the remote machine.
|
||||
|
||||
If you're still having problems, it may be necessary to edit your `gpg-agent.conf` file on both your remote and local machines to add the following information.
|
||||
|
||||
```
|
||||
enable-ssh-support
|
||||
pinentry-program /usr/bin/pinentry-curses
|
||||
default-cache-ttl 60
|
||||
max-cache-ttl 120
|
||||
extra-socket /run/user/1000/gnupg/S.gpg-agent.extra
|
||||
```
|
||||
|
||||
## GitHub
|
||||
|
||||
You can use YubiKey to sign GitHub commits and tags. It can also be used for GitHub SSH authentication, allowing you to push, pull, and commit without a password.
|
||||
|
|
@ -1465,56 +1516,6 @@ StreamLocalBindUnlink yes
|
|||
|
||||
**Note** Agent forwarding may be chained through multiple hosts - just follow the same [protocol](#remote-host-configuration) to configure each host.
|
||||
|
||||
# Remote Machines (agent forwarding)
|
||||
|
||||
If you want to use your YubiKey to sign a git commit on a remote machine, or ssh through another layer, then this is possible using "Agent Forwarding". To do this, you need to already have shell access to your remote machime, and your YubiKey setup on your host machine.
|
||||
|
||||
- First, on your host machine run:
|
||||
|
||||
```
|
||||
$ gpgconf --list-dirs agent-extra-socket
|
||||
```
|
||||
|
||||
This should return a path to your agent-extra-socket, which should look similar to `/run/user/1000/gnupg/S.gpg-agent.extra`.
|
||||
|
||||
- Next, find the agent socket on your **remote** machine:
|
||||
|
||||
```
|
||||
$ gpgconf --list-dirs agent-socket
|
||||
```
|
||||
|
||||
This should return a path such as `/run/user/1000/gnupg/S.gpg-agent`.
|
||||
|
||||
- On your remote machine, edit the file `/etc/ssh/sshd_config`, so that option `StreamLocalBindUnlink` is set to `StreamLocalBindUnlink yes`
|
||||
|
||||
- _(optional)_If you do not have root access to the remote machine to edit `/etc/ssh/sshd_config`, you will need to remove the socket on the remote machine before forwarding works. For example, `rm /run/user/1000/gnupg/S.gpg-agent`. Further information can be found on the [AgentForwarding GNUPG wiki page](https://wiki.gnupg.org/AgentForwarding).
|
||||
|
||||
- On your local machine, you need to copy your public keyring to your remote machine
|
||||
|
||||
```
|
||||
$ scp .gnupg/pubring.kbx remote:~/.gnupg/
|
||||
```
|
||||
|
||||
- Finally, to enable agent forwarding for a given machine, add the following to your ssh config file (your agent sockets may be different):
|
||||
|
||||
```
|
||||
Host remote
|
||||
ForwardAgent yes
|
||||
RemoteForward /run/user/1000/gnupg/S.gpg-agent /run/user/1000/gnupg/S.gpg-agent.extra
|
||||
# RemoteForward [remote socket] [local socket]
|
||||
```
|
||||
|
||||
You should then be able to use your YubiKey as if it were connected to the remote machine.
|
||||
|
||||
If you're still having problems, it may be necessary to edit your `gpg-agent.conf` file on both your remote and local machines to add the following information.
|
||||
|
||||
```
|
||||
enable-ssh-support
|
||||
pinentry-program /usr/bin/pinentry-curses
|
||||
default-cache-ttl 60
|
||||
max-cache-ttl 120
|
||||
extra-socket /run/user/1000/gnupg/S.gpg-agent.extra
|
||||
```
|
||||
|
||||
# Troubleshooting
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue