aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/docs/yubikey.md
diff options
context:
space:
mode:
authorToby Vincent <tobyv13@gmail.com>2022-01-30 13:41:57 -0600
committerToby Vincent <tobyv13@gmail.com>2022-01-30 13:41:57 -0600
commit105358cba1a557e350a44a5a7e4fe87fd2388d1b (patch)
tree8acf564efd6305694fd21ce6f58953330be4189b /docs/yubikey.md
parent7119a3713331d61de1b4cfe16c68703c097c758e (diff)
chore: updated to use new version of gpg-bridge
Diffstat (limited to 'docs/yubikey.md')
-rw-r--r--docs/yubikey.md124
1 files changed, 33 insertions, 91 deletions
diff --git a/docs/yubikey.md b/docs/yubikey.md
index 8069af0..a6adfb4 100644
--- a/docs/yubikey.md
+++ b/docs/yubikey.md
@@ -12,7 +12,7 @@
The following two sections are the result of a painstaking amount of google searches and GitHub issues followed by troubleshooting, tears, and tea breaks. Well, more accurately, the 20% came from the aforementioned alliteration. The 80% came from the following two guides.
- [drduh/YubiKey-Guide](https://github.com/drduh/YubiKey-Guide)
- - [The ultimate guide to Yubikey on WSL2](https://dev.to/dzerycz/series/11353)
+ - [The ultimate guide to YubiKey on WSL2](https://dev.to/dzerycz/series/11353)
- [Forwarding gpg-agent to a remote system over SSH](https://wiki.gnupg.org/AgentForwarding)
The former is an incredibly detailed guide to setting up GPG keys using YubiKey as a smart card. The amount of information drduh has organized in that repository in immense, so I urge you to go star it if you find anything in this section helpful, as he deserves at least that much.
@@ -21,126 +21,68 @@ The second guide was used more as a reference/verification source for the first
While I went down this rock filled rabbit hole for the purpose of getting my YubiKey working (seamlessly) in WSL2, the majority of this should be helpful even if you don't use a security key, as its specificity deals with getting the respective agents/sockets communicating between WSL2 and Windows.
-## SSH Agent
-### In WSL
+<!-- TODO ssh/git config to use gpnupg -->
+<!-- TODO setting up remote gpg/ssh forwarding -->
-```sh
-# Bash
+## Windows
-# Install depends
-sudo apt install socat iproute2
-
-# Install wsl2-ssh-pageant
-destination="$HOME/.ssh/wsl2-ssh-pageant.exe"
-curl -sL "https://github.com/BlackReloaded/wsl2-ssh-pageant/releases/latest/download/wsl2-ssh-pageant.exe" -o "$destination"
-# wget -O "$destination" "https://github.com/BlackReloaded/wsl2-ssh-pageant/releases/latest/download/wsl2-ssh-pageant.exe"
-# Set the executable bit.
-chmod +x "$destination"
-```
+### SSH Agent
-### In Windows
-
-Download [wsl-ssh-pageant](https://github.com/benpye/wsl-ssh-pageant)
+Install [gpg-bridge](https://github.com/BusyJay/gpg-bridge) using cargo
```powershell
# Powershell
-
-# Using scoop (https://scoop.sh/)
-scoop bucket add extras
-scoop install wsl-ssh-pageant
+cargo install -f --git https://github.com/busyjay/gpg-bridge
```
-Set variables
-
-**Note** The version with '-gui', i.e. 'wsl-ssh-pageant-gui', ***has no*** gui/tray icon, while 'wsl-ssh-pageant' ***has*** a gui/tray icon. Use which ever you find most useful
+Set gpg-bridge to run on startup
```powershell
# Powershell
-
-# Can be any name
-$pipe = "ssh-pageant"
-
-# Path to either wsl-ssh-pageant or wsl-ssh-pageant-gui executable
-$pageant = "$env:SCOOP\apps\wsl-ssh-pageant\current\wsl-ssh-pageant-gui.exe"
-
-[System.Environment]::SetEnvironmentVariable('SSH_AUTH_SOCK',"\\.\pipe\$pipe")
+$cmdl = "$HOME\.cargo\bin\gpg-bridge.exe gpg-bridge-ssh --extra 127.0.0.1:4321 --ssh \\.\pipe\gpg-bridge-ssh --detach"
+$key = New-Item -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force
+New-ItemProperty -Path $key.PSPath -Name "gpg-bridge" -Value "$cmdl"
```
-Set it to autostart on login
+Set SSH_AUTH_SOCK to have ssh use the translated pipe
```powershell
# Powershell
-
-$path = 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
-$cmdl = "$pageant --winssh $pipe"
-$key = try {
- Get-Item -Path $path -ErrorAction Stop
-}
-catch {
- New-Item -Path $path -Force
-}
-
-New-ItemProperty -Path $key.PSPath -Name "wsl-ssh-pageant" -Value "$cmdl"
-```
-<!-- Not sure if the following is needed or not. I thought it was but at the time of writing, I realize I did NOT have the .ssh/ssh.BAT file. So it may not be needed.
-
-### VS Code
-
-Due to how VS Code calls ssh, I found it necessary to create a shim for the WSL ssh bin.
-
-First create the following .bat file somewhere in your Windows fs.
-
-```bat
-
+[System.Environment]::SetEnvironmentVariable('SSH_AUTH_SOCK',"\\.\pipe\gpg-bridge-ssh")
```
-Then, in VS Code, put the following in your settings.JSON,
-
-```json
-{
- "remote.SSH.path": "C:\\Users\\tobyv\\.ssh\\ssh.BAT",
-}
-``` -->
-
-<!-- TODO ssh/git config to use gpnupg -->
-
-## GPG Agent
-
-### Windows
-
-Download [gpg-bridge](https://github.com/BusyJay/gpg-bridge)
-
-Set variables
+One-off to run gpg-bridge.exe without restarting
```powershell
# Powershell
+Invoke-Expression "& $cmdl"
+```
-# Can be any free port
-$port = 4444
+### GPG Agent
-$bridge = "$HOME\.cargo\bin\gpg-bridge.exe"
-```
+On the windows side the YubiKey is fully accessible, the GPG agent should just work.
-Set it to autostart on login
+## In WSL2
-```powershell
-# Powershell
+### SSH Agent
-$path = 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
-$cmdl = "$bridge gpg-bridge --extra 127.0.0.1:$port --ssh \\.\pipe\gpg-bridge-ssh --detach"
-$key = try {
- Get-Item -Path $path -ErrorAction Stop
-}
-catch {
- New-Item -Path $path -Force
-}
+```sh
+# Bash
-New-ItemProperty -Path $key.PSPath -Name "gpg-bridge" -Value "$cmdl"
+# Install depends
+sudo apt install socat iproute2
+
+# Install wsl2-ssh-pageant
+destination="$HOME/.ssh/wsl2-ssh-pageant.exe"
+curl -sL "https://github.com/BlackReloaded/wsl2-ssh-pageant/releases/latest/download/wsl2-ssh-pageant.exe" -o "$destination"
+# wget -O "$destination" "https://github.com/BlackReloaded/wsl2-ssh-pageant/releases/latest/download/wsl2-ssh-pageant.exe"
+# Set the executable bit.
+chmod +x "$destination"
```
-### In WSL2
+### GPG Agent
-The only setup needed for getting the YubiKey working in WSL2 is to source/copy-paste [gpg.sh](shell/gpg.sh) in your shell profile.
+The only setup needed for getting the YubiKey working in WSL2 is to source/copy-paste [gpg.sh](wsl/gpg.sh) in your shell profile.
Along with the initialization code, I wrote a small function the resets all the related agents/sockets. If you do not attempt to access the YubiKey while it is not inserted, in my experience, GPG works great has no issues once reinserting the YubiKey. It is only (inconsistently) when you try to access a YubiKey that you have removed that puts it in a failed state. \ No newline at end of file