Useful commands:

  • gpg --export-ssh-key <uid>: Retrieve public key part of GPG/(used for) SSH (authentication) key.
  • ssh-add --apple-use-keychain
  • killall ssh-agent
  • gpg --export --armor 3921648AF0ADA1F6
  • gpg -K --keyid-format long --with-keygrip
  • gpgconf --launch gpg-agent: Launch gpg-agent manually.
  • ps aux | grep <gpg-agent|ssh-agent>: Check if gpg-agent/ssh-agent is running.
  • set -x SSH_AUTH_SOCK $(gpgconf --list-dirs agent-ssh-socket): Tell SSH how to access gpg-agent by setting environment variable SSH_AUTH_SOCK.
  • ssh-add -L: Get SSH key fingerprint.
  • gpgconf --kill gpg-agent
  • ssh-agent -k: Kill the current running ssh-agent.

Configure SSH to use GPG agent for authentication:

  1. echo $SSH_AUTH_SOCK: Check current SSH_AUTH_SOCK, it may look like /private/tmp/com.apple.launchd.BhS0P6FUJX/Listeners on Mac.
  2. set -x SSH_AUTH_SOCK $(gpgconf --list-dirs agent-ssh-socket): Change that environment variable (SSH_AUTH_SOCK) to tell SSH how to access gpg-agent.
    • Rerun echo $SSH_AUTH_SOCK, it should output:
      • /Users/thom/.gnupg/S.gpg-agent.ssh
  3. gpgconf --launch gpg-agent: Now, launch gpg-agent.
    • If it’s not working (when we check by using ssh -T git@github.com failed), kill the current running gpg-agent: gpgconf --kill gpg-agent. Try gpg-agent --daemon/gpgconf --launch gpg-agent instead.
    • OR use reload agent command: gpg-connect-agent reloadagent /bye. (Reference)
  4. ssh-add -L: Use this command to check current identities. You can see it’s activated.
    • It should output something like:
      • ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILPHzucXNBTMScAYA84tNcCs53L2WmveAVOZDuEP3x8p (none)
      • This ⬆️ can be retrieved via gpg --export-ssh-key <uid>.

Retrieve SSH Key passphrase from Apple Keychain and add it to the ssh-agent for SSH authentication:

  1. ssh-add -L: Check current ssh-agent authentication state.
  2. ssh-add --apple-use-keychain: Add SSH private key to the ssh-agent using passphrase stored in the keychain.
  3. ssh -T git@github.com: Test connection.
  4. Done.

How to setup GPG for SSH authentication:

  1. Edit ~/.gnupg/gpg-agent.conf file, echo "enable-ssh-support" >> ~/.gnupg/gpg-agent.conf.
  2. Create a subkey for authentication only, after creations, your keyring should look like this:
$ gpg -K --keyid-format long --with-keygrip
sec   rsa2048 2019-03-21 [SC] [expires: 2021-03-20]
      96F33EA7F4E0F7051D75FC208715AF32191DB135
      Keygrip = P68H43D8SEHZ45P9PJYX9VEQP3EPAK30SCGY6I17
uid           [ultimate] Brian Rebort
ssb   rsa2048 2019-03-21 [E] [expires: 2021-03-20]
      Keygrip = VUJ6OZ29NSGI1EIH373GKR90N0EMNOH1XWMHXO9C
ssb   rsa2048 2019-03-21 [A]
      Keygrip = 5U368R3PTB3E88LWW6PWMU6TG61C4GIYIAF68S3P
  1. Take a note of the newly created subkey’s keygrip, then: cat 5U368R3PTB3E88LWW6PWMU6TG61C4GIYIAF68S3P >> ~/.gnupg/sshcontrol.
  2. Lastly, change the environment variable SSH_AUTH_SOCK to the socket GPG agent setup for SSH communication: set -x SSH_AUTH_SOCK $(gpgconf --list-dirs agent-ssh-socket).

How to setup SSH Key for SSH authentication:

Knowledge:

$SSH_AUTH_SOCK contains the path of the unix file socket that the agent uses for communication with other processes. This is essential for ssh-add.

$SSH_AUTH_SOCK : Identifies the path of a UNIX-domain socket used to communicate with the agent.

When you run ssh-add, it communicates with the authentication agent (whether it’s ssh-agent or gpg-agent acting as an SSH agent) via the specified socket, and that’s what the SSH_AUTH_SOCK environment variable is used for.

The gpgconf --list-dirs agent-ssh-socket command is used to display the directory where the GnuPG (GPG) agent’s UNIX domain socket for SSH operations is located.

Reference: