Skip to content

Support GPG and smartcard users #827

New issue
New issue
Closed
Closed
Support GPG and smartcard users#827
Labels
0 - BacklogResolution - External

Description

@vovcacik
Vlastimil Ovčáčík (vovcacik)
opened on Jul 26, 2017

It seems like ssh.exe cannot use gpg-agent.exe since the latter is storing socket info in S.gpg-agent.ssh file and you expect it to be named pipe.

Are there any guidelines how to use ssh.exe and my authentication GPG key stored on smartcard?

EDITS:
https://dev.gnupg.org/T3883

Activity

  1. bagajjal commented on Jul 27, 2017

    @bagajjal
    bagajjal
    on Jul 27, 2017
    Collaborator

    As of now, we don't support this scenario. This will be added to our backlog and will be picked based on the priority.

  2. bagajjal
    added
    0 - Backlog
    Area-Core
    on Jul 27, 2017

  3. manojampalam commented on Aug 1, 2017

    @manojampalam
    Manoj Ampalam (manojampalam)
    on Aug 1, 2017
    Contributor

    Is gpg-agent listening on a network socket?

  4. vovcacik commented on Aug 12, 2017

    @vovcacik
    Vlastimil Ovčáčík (vovcacik)
    on Aug 12, 2017
    Author

    Manoj Ampalam (@manojampalam) yes, the gpg-agent creates S.gpg-agent.ssh file with TCP port number it listens on and authorization cookie. I believe this way it is compatible with cygwin environment, but unfortunately not with this project (that is using named pipes).

  5. vovcacik commented on Aug 12, 2017

    @vovcacik
    Vlastimil Ovčáčík (vovcacik)
    on Aug 12, 2017
    Author

    bagajjal I understand, thanks.

    When you get to it, make sure you work with the official Windows builds available from gpg ftp (ftp://ftp.gnupg.org/gcrypt/binary/). It is far more superior than Gpg4win, but it is bit hidden out of sight and not advertised at all.

  6. Manoj Ampalam (manojampalam)
    changed the title [-]Recommendation for GPG and smartcard users[/-] [+]Support GPG and smartcard users[/+] on Aug 14, 2017

  7. manojampalam commented on Aug 14, 2017

    @manojampalam
    Manoj Ampalam (manojampalam)
    on Aug 14, 2017
    Contributor

    Vlastimil Ovčáčík (@vovcacik) your understanding is correct. On Windows the logical equivalent of Unix Domain Sockets is named pipes (that inherently provides authorization capabilities). We unfortunately have no alternative way to use smartcards with this version of OpenSSH. Its a feature that we need to implement for Windows.
    You'll have to stick with Cygwin for now (if it works).

  8. charabaruk commented on Dec 7, 2017

    @charabaruk
    Chris Charabaruk (charabaruk)
    on Dec 7, 2017

    Given that UNIX domain sockets are pretty similar to Windows named pipes, I wonder if it'd be possible to create a program that sets up a named pipe that gets assigned to $SSH_AUTH_SOCK and then proxies between that and the socket set up by gpg-agent. I have a couple of concerns about that, though:

    1. Is the protocol used by ssh-agent over named pipes byte-for-byte the same as for ssh-agent over domain sockets? That is, are there endianness issues that need to be considered, or a need to translate between gpg-agent's ssh-agent protocol implementation and Win32-OpenSSH's?
    2. The socket files created by gpg-agent on Windows may match the structure used by Cygwin or MSYS, but don't necessarily do so. For example, on my machine right now S.gpg-agent.ssh only includes a 16-byte cookie, rather than the Cygwin socket header and port number.

  9. vovcacik commented on Dec 7, 2017

    @vovcacik
    Vlastimil Ovčáčík (vovcacik)
    on Dec 7, 2017
    Author

    My S.gpg-agent.ssh contains port number and 16 byte cookie. I am using ftp://ftp.gnupg.org/gcrypt/binary/.

  10. charabaruk commented on Dec 7, 2017

    @charabaruk
    Chris Charabaruk (charabaruk)
    on Dec 7, 2017

    Vlastimil Ovčáčík (@vovcacik) what version of GPG do you have installed, and is it a Cygwin or MSYS build? They each have their own format for the sock file (or more than one possible format), all of which would need to be supported.

  11. vovcacik commented on Dec 7, 2017

    @vovcacik
    Vlastimil Ovčáčík (vovcacik)
    on Dec 7, 2017
    Author

    @coldacid it is neither Cygwin-based, MSYS-based nor Gpg4win, but rather official native build.

    gpg (GnuPG) 2.1.21
libgcrypt 1.7.6

  12. charabaruk commented on Dec 7, 2017

    @charabaruk
    Chris Charabaruk (charabaruk)
    on Dec 7, 2017

    Vlastimil Ovčáčík (@vovcacik) Gpg4win uses the "official native build" as you put it. Could you update to 2.2.3 and see what the socket file looks like afterwards?

  13. manojampalam commented on Dec 7, 2017

    @manojampalam
    Manoj Ampalam (manojampalam)
    on Dec 7, 2017
    Contributor

    Protocol used by Windows version of ssh-agent is the same as in Unix. So a named pipe to network sock interop adapter should work for your case.

  14. charabaruk commented on Dec 7, 2017

    @charabaruk
    Chris Charabaruk (charabaruk)
    on Dec 7, 2017

    Manoj Ampalam (@manojampalam) excellent. I'll take some time this weekend to prototype one out.

  15. 84 remaining items

  16. thxkiwi commented on Feb 10, 2023

    @thxkiwi
    Michael Ngarimu (thxkiwi)
    on Feb 10, 2023

    Coming back to this on a Windows 11 22H2 machine, I now get what others have been experiencing "invalid format" resulting from ssh-add -L when using SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket)

    I observe, similarly to Kaylyn Bogle (@kaylynb) , the \\.\pipe\openssh-ssh-agent socket is not created by gpg-agent.

    I observe that gpgconf --list-dirs agent-ssh-agent shows the AppData\Local\gnupg\S.gpg-agent.ssh location.

    ssh -V
OpenSSH_for_Windows_8.6p1, LibreSSL 3.4.3

    UPDATE

    I've tried using what previously worked for me in #827 (comment) but now get

    error fetching identities: agent refused operation

  17. thxkiwi commented on Feb 11, 2023

    @thxkiwi
    Michael Ngarimu (thxkiwi)
    on Feb 11, 2023

    My Windows 11 22H2 Issues Resolved

    Software Installed

    • gpg4win / Kleopatra
    gpg --version
gpg (GnuPG) 2.4.0
libgcrypt 1.10.1
Copyright (C) 2021 g10 Code GmbH
License GNU GPL-3.0-or-later <https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: C:\Users\MichaelKiwiNgarimu\AppData\Roaming\gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
        CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

gpgconf -V
* GnuPG 2.4.0 (c0556edb8)
MingW32
Windows 10.0 build 22621

* Libgcrypt 1.10.1 (ae0e5678)
version:1.10.1:10a01:1.46:12e00:
cc:80300:gcc:8.3-win32 20190406:
ciphers:arcfour:blowfish:cast5:des:aes:twofish:serpent:rfc2268:seed:camellia:idea:salsa20:gost28147:chacha20:sm4:
pubkeys:dsa:elgamal:rsa:ecc:
digests:crc:gostr3411-94::md4:md5:rmd160:sha1:sha256:sha512:sha3:tiger:whirlpool:stribog:blake2:sm3:
rnd-mod:w32:
cpu-arch:x86:
mpi-asm:i386/mpih-add1.S:i386/mpih-sub1.S:i386/mpih-mul1.S:i386/mpih-mul2.S:i386/mpih-mul3.S:i386/mpih-lshift.S:i386/mpih-rshift.S:
hwflist:intel-cpu:intel-bmi2:intel-ssse3:intel-sse4.1:intel-pclmul:intel-aesni:intel-rdrand:intel-avx:intel-avx2:intel-fast-vpgather:intel-rdtsc:intel-shaext:intel-vaes-vpclmul:
fips-mode:n:::
rng-type:standard:1:3030000:1:
compliance:::

* GpgRT 1.46 (ea03187)

* Libassuan 2.5.5 (f8cfb56)

* KSBA 1.6.3 (bffa9b3)

* NTBTLS 0.3.1 (802494e)
    • OpenSSH
    Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH*'
Name  : OpenSSH.Client~~~~0.0.1.0
State : Installed

Name  : OpenSSH.Server~~~~0.0.1.0
State : NotPresent

ssh -V
OpenSSH_for_Windows_8.6p1, LibreSSL 3.4.3

    gpg.conf

    None

    gpg-agent.conf

    debug-level 4
log-file c:\Users\Me\.gnupg\gpg-agent.log
enable-ssh-support
enable-putty-support
enable-win32-openssh-support
use-standard-socket

    sshcontrol

    Created using the output from

    gpg --list-secret-keys --with-keygrips

    Copy and paste the key grip of the authentication key into the file. Include a newline after the 40-byte key grip ID.

    Running gpg-agent

    • Run gpg-connect-agent /bye as your user
      • Do not run gpg-agent or gpg-connect-agent elevated

    Errors and How I Resolved Them

    access denied

    • I would get this if I ran gpg-agent/gpg-connect-agent elevated

    invalid format

    • Seems to be when $env:SSH_AUTH_SOCK is using the $(gpgconf --list-dirs agent-ssh-socket)
      • Solution: manually set $env:SSH_AUTH_SOCK="\\.\pipe\openssh-ssh-agent

    agent refused operation

    • gpg-agent.log shows 2023-02-11 03:33:59 gpg-agent[14932] ssh request identities failed: Line too long <GPG Agent>
    • Initially I created sshcontrol using echo <value> >> sshcontrol
      • Maybe this puts an extra non-printable character or something somewhere in the file
      • I recreated an empty file in VSCode, added the contents as described above and saved it as sshcontrol

  18. j1g5awi commented on Mar 17, 2023

    @j1g5awi
    Jigsaw (j1g5awi)
    on Mar 17, 2023

    My Issues Resolved

    DISABLE the openssh ssh-agent Windows service IS IMPORTANT

    Kirill Belousov (@cyrmax) Anon-4 SamJakob (@SamJakob) Have you slove this problem ?

    I have met the same problem, get The agent has no identities. from ssh-add -l any way, I think I need some help.

    There is my env below:

    Windows 11

    22H2 22621.1413

    GPG

     gpg --version

gpg (GnuPG) 2.4.0
libgcrypt 1.10.1
Copyright (C) 2021 g10 Code GmbH
License GNU GPL-3.0-or-later <https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: C:\Users\Admin\.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
        CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

 gpgconf -V

* GnuPG 2.4.0 (c0556edb8)
MingW32
Windows 10.0 build 22621

* Libgcrypt 1.10.1 (ae0e5678)
version:1.10.1:10a01:1.46:12e00:
cc:80300:gcc:8.3-win32 20190406:
ciphers:arcfour:blowfish:cast5:des:aes:twofish:serpent:rfc2268:seed:camellia:idea:salsa20:gost28147:chacha20:sm4:
pubkeys:dsa:elgamal:rsa:ecc:
digests:crc:gostr3411-94::md4:md5:rmd160:sha1:sha256:sha512:sha3:tiger:whirlpool:stribog:blake2:sm3:
rnd-mod:w32:
cpu-arch:x86:
mpi-asm:i386/mpih-add1.S:i386/mpih-sub1.S:i386/mpih-mul1.S:i386/mpih-mul2.S:i386/mpih-mul3.S:i386/mpih-lshift.S:i386/mpih-rshift.S:
hwflist:intel-cpu:intel-fast-shld:intel-bmi2:intel-ssse3:intel-sse4.1:intel-pclmul:intel-aesni:intel-rdrand:intel-avx:intel-avx2:intel-fast-vpgather:intel-rdtsc:
fips-mode:n:::
rng-type:standard:1:3030000:1:
compliance:::

* GpgRT 1.46 (ea03187)

* Libassuan 2.5.5 (f8cfb56)

* KSBA 1.6.3 (bffa9b3)

* NTBTLS 0.3.1 (802494e)

    gpg-agent.conf

    ###+++--- GPGConf ---+++###
enable-ssh-support
enable-putty-support
enable-win32-openssh-support
use-standard-socket

    OpenSSH

    OpenSSH_for_Windows_9.2p1, LibreSSL 3.6.1

  19. thxkiwi commented on Mar 23, 2023

    @thxkiwi
    Michael Ngarimu (thxkiwi)
    on Mar 23, 2023

    Jigsaw (@j1g5awi)

    1. Have you stopped the openssh ssh-agent Windows service?
    PS> Get-Service ssh-agent

Status   Name               DisplayName
------   ----               -----------
Stopped  ssh-agent          OpenSSH Authentication Agent
    1. Have you ensured that gpg-agent is running?
    PS> gpg-connect-agent "killagent" /bye
OK closing connection
PS> gpg-connect-agent /bye
gpg-connect-agent: no running gpg-agent - starting 'C:\\Program Files (x86)\\GnuPG\\bin\\gpg-agent.exe'
gpg-connect-agent: waiting for the agent to come up ... (5s)
gpg-connect-agent: connection to the agent established

    If you're still not seeing any keys output from ssh-add -L then try getting gpg-agent logs (see my earlier comment above). The same comment lists the errors that I encountered and how I resolved them. I hope some of this helps you.

  20. j1g5awi commented on Mar 24, 2023

    @j1g5awi
    Jigsaw (j1g5awi)
    on Mar 24, 2023

    Michael Ngarimu (@thxkiwi) Thanks your help!

    I got logs below:

    2023-03-24 11:04:32 gpg-agent[10616] listening on socket 'C:\\Users\\Admin\\AppData\\Local\\gnupg\\d.mq77ymnxxdn7hyts\\S.gpg-agent'
2023-03-24 11:04:32 gpg-agent[10616] listening on socket 'C:\\Users\\Admin\\AppData\\Local\\gnupg\\d.mq77ymnxxdn7hyts\\S.gpg-agent.extra'
2023-03-24 11:04:32 gpg-agent[10616] listening on socket 'C:\\Users\\Admin\\AppData\\Local\\gnupg\\d.mq77ymnxxdn7hyts\\S.gpg-agent.browser'
2023-03-24 11:04:32 gpg-agent[10616] listening on socket 'C:\\Users\\Admin\\AppData\\Local\\gnupg\\d.mq77ymnxxdn7hyts\\S.gpg-agent.ssh'
2023-03-24 11:04:32 gpg-agent[10616] gpg-agent (GnuPG) 2.4.0 started
2023-03-24 11:04:32 gpg-agent[10616] putty message loop thread started
2023-03-24 11:04:32 gpg-agent[10616] Win32-OpenSSH thread started
2023-03-24 11:04:32 gpg-agent[10616] cannot create pipe: 5
2023-03-24 11:04:32 gpg-agent[10616] Win32-OpenSSH thread stopped
2023-03-24 11:04:32 gpg-agent[10616] DBG: chan_0x000002b8 -> OK Pleased to meet you
2023-03-24 11:04:32 gpg-agent[10616] DBG: chan_0x000002b8 <- RESET
2023-03-24 11:04:32 gpg-agent[10616] DBG: chan_0x000002b8 -> OK
2023-03-24 11:04:32 gpg-agent[10616] DBG: chan_0x000002b8 <- killagent
2023-03-24 11:04:32 gpg-agent[10616] DBG: chan_0x000002b8 -> OK closing connection
2023-03-24 11:04:32 gpg-agent[10616] secmem usage: 0/32768 bytes in 0 blocks

    Do you know what does it mean?

  21. thxkiwi commented on Mar 24, 2023

    @thxkiwi
    Michael Ngarimu (thxkiwi)
    on Mar 24, 2023

    I think "5" relates to a Windows HRESULT "ERROR_ACCESS_DENIED". I saw that error when I was running gpg-agent with elevated privileges. Are you running gpg-agent with elevated privileges, or as administrator?

  22. j1g5awi commented on Mar 24, 2023

    @j1g5awi
    Jigsaw (j1g5awi)
    on Mar 24, 2023

    I just install gpg4win from their offical website, and open the Kleopatra in Desktop icon, and never see any prompt for elevating privilege.

  23. char-46 commented on May 23, 2023

    @char-46
    char46 (char-46)
    on May 23, 2023

    Eh, I think I met a other question.
    When I type ssh-add -L, the error message The agent has no identities and the correct message ssh-sth here (none) appear alternately.

    My Environment:

    Windows 11 22H2 (OS 22621.1702)

    gpg-agent run as Administrator

    PS> gpg --version
gpg (GnuPG) 2.4.0
libgcrypt 1.10.1
Copyright (C) 2021 g10 Code GmbH
License GNU GPL-3.0-or-later <https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: C:\Users\Me\AppData\Roaming\gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
        CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

PS> gpgconf -V
* GnuPG 2.4.0 (c0556edb8)
MingW32
Windows 10.0 build 22621

* Libgcrypt 1.10.1 (ae0e5678)
version:1.10.1:10a01:1.46:12e00:
cc:80300:gcc:8.3-win32 20190406:
ciphers:arcfour:blowfish:cast5:des:aes:twofish:serpent:rfc2268:seed:camellia:idea:salsa20:gost28147:chacha20:sm4:
pubkeys:dsa:elgamal:rsa:ecc:
digests:crc:gostr3411-94::md4:md5:rmd160:sha1:sha256:sha512:sha3:tiger:whirlpool:stribog:blake2:sm3:
rnd-mod:w32:
cpu-arch:x86:
mpi-asm:i386/mpih-add1.S:i386/mpih-sub1.S:i386/mpih-mul1.S:i386/mpih-mul2.S:i386/mpih-mul3.S:i386/mpih-lshift.S:i386/mpih-rshift.S:
hwflist:intel-bmi2:intel-ssse3:intel-sse4.1:intel-pclmul:intel-aesni:intel-rdrand:intel-avx:intel-avx2:intel-rdtsc:intel-shaext:intel-vaes-vpclmul:
fips-mode:n:::
rng-type:standard:1:3030000:1:
compliance:::

* GpgRT 1.46 (ea03187)

* Libassuan 2.5.5 (f8cfb56)

* KSBA 1.6.3 (bffa9b3)

* NTBTLS 0.3.1 (802494e)

PS> ssh -V
OpenSSH_for_Windows_9.2p1, LibreSSL 3.7.2

PS> Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH*'


Name  : OpenSSH.Client~~~~0.0.1.0
State : NotPresent

Name  : OpenSSH.Server~~~~0.0.1.0
State : NotPresent

PS> echo $env:SSH_AUTH_SOCK
\\.\pipe\openssh-ssh-agent

    gpg.conf

    use-agent

    gpg-agent.conf

    debug-level 4
log-file c:\Users\Me\gpg\gpg-agent.log
enable-ssh-support
enable-putty-support
enable-win32-openssh-support

    keygrip from gpg --list-secret-keys --with-keygrip is in sshcontrol

  24. namelessmasses commented on May 27, 2023

    @namelessmasses
    Michael "Kiwi" Ngarimu (namelessmasses)
    on May 27, 2023

    I just install gpg4win from their offical website, and open the Kleopatra in Desktop icon, and never see any prompt for elevating privilege.

    I would see that error if I was running gpg-agent or gpg-connect-agent elevated.

  25. namelessmasses commented on May 27, 2023

    @namelessmasses
    Michael "Kiwi" Ngarimu (namelessmasses)
    on May 27, 2023

    Eh, I think I met a other question. When I type ssh-add -L, the error message The agent has no identities and the correct message ssh-sth here (none) appear alternately.
    ...

    PS> echo $env:SSH_AUTH_SOCK
    \.\pipe\openssh-ssh-agent

    Does the pipe exist?

    gpg-agent.conf

    debug-level 4
log-file c:\Users\Me\gpg\gpg-agent.log
enable-ssh-support
enable-putty-support
enable-win32-openssh-support

    Have you checked the logs for any errors?

    keygrip from gpg --list-secret-keys --with-keygrip is in sshcontrol

    Is this file formatted correctly? I found sshcontrol to be quite finicky. Check the file contents against the documented format for sshcontrol (https://www.gnupg.org/documentation/manuals/gnupg/Agent-Configuration.html)

  26. piotrpdev commented on Jan 27, 2024

    @piotrpdev
    Piotr Płaczek (piotrpdev)
    on Jan 27, 2024
    1. Have you stopped the openssh ssh-agent Windows service?
    PS> Get-Service ssh-agent

Status   Name               DisplayName
------   ----               -----------
Stopped  ssh-agent          OpenSSH Authentication Agent

    Thanks for this, I stopped the service and it fixed my issues :)

    It was also set to "Automatic" startup for some reason so I disabled it.

  27. lislon commented on May 29, 2024

    @lislon
    Igor Golovin (lislon)
    on May 29, 2024

    I want to add that if you encounter the issue ssh request identities failed: Line too long <GPG Agent>, make sure that
    sshcontrol (In my case c:/Users/USER/AppData/Roaming/gnupg/sshcontrol) ends with unix-end line \n. Even if it contains just a single keygrip, it should have new-line character at the end.
    Reference: https://github.com/gpg/gnupg/blob/9adaa79ab43e2f87178b8ee5ab1a353cba384606/g10/tdbdump.c#L160-L161

  28. bencejuhaasz commented on Sep 17, 2024

    @bencejuhaasz
    Juhász Bence (bencejuhaasz)
    on Sep 17, 2024

    I followed the guide, but I get

    ssh-add -l
Error connecting to agent: No such file or directory

    after setting $env:SSH_AUTH_SOCK="\.\pipe\openssh-ssh-agent"

  29. RainCat1998 commented on Oct 13, 2024

    @RainCat1998
    RainCat1998
    on Oct 13, 2024

    My Issues Resolved

    DISABLE the openssh ssh-agent Windows service IS IMPORTANT

    Kirill Belousov (@cyrmax) Anon-4 SamJakob (@SamJakob) Have you slove this problem ?

    I have met the same problem, get The agent has no identities. from ssh-add -l any way, I think I need some help.

    There is my env below:

    Windows 11

    22H2 22621.1413

    GPG

     gpg --version

gpg (GnuPG) 2.4.0
libgcrypt 1.10.1
Copyright (C) 2021 g10 Code GmbH
License GNU GPL-3.0-or-later <https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: C:\Users\Admin\.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
        CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

 gpgconf -V

* GnuPG 2.4.0 (c0556edb8)
MingW32
Windows 10.0 build 22621

* Libgcrypt 1.10.1 (ae0e5678)
version:1.10.1:10a01:1.46:12e00:
cc:80300:gcc:8.3-win32 20190406:
ciphers:arcfour:blowfish:cast5:des:aes:twofish:serpent:rfc2268:seed:camellia:idea:salsa20:gost28147:chacha20:sm4:
pubkeys:dsa:elgamal:rsa:ecc:
digests:crc:gostr3411-94::md4:md5:rmd160:sha1:sha256:sha512:sha3:tiger:whirlpool:stribog:blake2:sm3:
rnd-mod:w32:
cpu-arch:x86:
mpi-asm:i386/mpih-add1.S:i386/mpih-sub1.S:i386/mpih-mul1.S:i386/mpih-mul2.S:i386/mpih-mul3.S:i386/mpih-lshift.S:i386/mpih-rshift.S:
hwflist:intel-cpu:intel-fast-shld:intel-bmi2:intel-ssse3:intel-sse4.1:intel-pclmul:intel-aesni:intel-rdrand:intel-avx:intel-avx2:intel-fast-vpgather:intel-rdtsc:
fips-mode:n:::
rng-type:standard:1:3030000:1:
compliance:::

* GpgRT 1.46 (ea03187)

* Libassuan 2.5.5 (f8cfb56)

* KSBA 1.6.3 (bffa9b3)

* NTBTLS 0.3.1 (802494e)

    gpg-agent.conf

    ###+++--- GPGConf ---+++###
enable-ssh-support
enable-putty-support
enable-win32-openssh-support
use-standard-socket

    OpenSSH

    OpenSSH_for_Windows_9.2p1, LibreSSL 3.6.1

    Yes, all you need is DISABLE the openssh ssh-agent Windows service.

  30. kolade-ogunleye commented on Apr 5, 2025

    @kolade-ogunleye
    kolade-ogunleye
    on Apr 5, 2025

    My Windows 11 22H2 Issues Resolved

    Software Installed

    • gpg4win / Kleopatra
    gpg --version
gpg (GnuPG) 2.4.0
libgcrypt 1.10.1
Copyright (C) 2021 g10 Code GmbH
License GNU GPL-3.0-or-later <https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: C:\Users\MichaelKiwiNgarimu\AppData\Roaming\gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
        CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

gpgconf -V
* GnuPG 2.4.0 (c0556edb8)
MingW32
Windows 10.0 build 22621

* Libgcrypt 1.10.1 (ae0e5678)
version:1.10.1:10a01:1.46:12e00:
cc:80300:gcc:8.3-win32 20190406:
ciphers:arcfour:blowfish:cast5:des:aes:twofish:serpent:rfc2268:seed:camellia:idea:salsa20:gost28147:chacha20:sm4:
pubkeys:dsa:elgamal:rsa:ecc:
digests:crc:gostr3411-94::md4:md5:rmd160:sha1:sha256:sha512:sha3:tiger:whirlpool:stribog:blake2:sm3:
rnd-mod:w32:
cpu-arch:x86:
mpi-asm:i386/mpih-add1.S:i386/mpih-sub1.S:i386/mpih-mul1.S:i386/mpih-mul2.S:i386/mpih-mul3.S:i386/mpih-lshift.S:i386/mpih-rshift.S:
hwflist:intel-cpu:intel-bmi2:intel-ssse3:intel-sse4.1:intel-pclmul:intel-aesni:intel-rdrand:intel-avx:intel-avx2:intel-fast-vpgather:intel-rdtsc:intel-shaext:intel-vaes-vpclmul:
fips-mode:n:::
rng-type:standard:1:3030000:1:
compliance:::

* GpgRT 1.46 (ea03187)

* Libassuan 2.5.5 (f8cfb56)

* KSBA 1.6.3 (bffa9b3)

* NTBTLS 0.3.1 (802494e)
    • OpenSSH
    Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH*'
Name  : OpenSSH.Client~~~~0.0.1.0
State : Installed

Name  : OpenSSH.Server~~~~0.0.1.0
State : NotPresent

ssh -V
OpenSSH_for_Windows_8.6p1, LibreSSL 3.4.3

    gpg.conf

    None

    gpg-agent.conf

    debug-level 4
log-file c:\Users\Me\.gnupg\gpg-agent.log
enable-ssh-support
enable-putty-support
enable-win32-openssh-support
use-standard-socket

    sshcontrol

    Created using the output from

    gpg --list-secret-keys --with-keygrips

    Copy and paste the key grip of the authentication key into the file. Include a newline after the 40-byte key grip ID.

    Running gpg-agent

    • Run gpg-connect-agent /bye as your user

      • Do not run gpg-agent or gpg-connect-agent elevated

    Errors and How I Resolved Them

    access denied

    • I would get this if I ran gpg-agent/gpg-connect-agent elevated

    invalid format

    • Seems to be when $env:SSH_AUTH_SOCK is using the $(gpgconf --list-dirs agent-ssh-socket)

      • Solution: manually set $env:SSH_AUTH_SOCK="\\.\pipe\openssh-ssh-agent

    agent refused operation

    • gpg-agent.log shows 2023-02-11 03:33:59 gpg-agent[14932] ssh request identities failed: Line too long <GPG Agent>

    • Initially I created sshcontrol using echo <value> >> sshcontrol

      • Maybe this puts an extra non-printable character or something somewhere in the file
      • I recreated an empty file in VSCode, added the contents as described above and saved it as sshcontrol

    This is a lifesaver in 2025.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    0 - BacklogResolution - External

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions