{"action":"created","issue":{"url":"https://api.github.com/repos/naggie/dotfiles/issues/120","repository_url":"https://api.github.com/repos/naggie/dotfiles","labels_url":"https://api.github.com/repos/naggie/dotfiles/issues/120/labels{/name}","comments_url":"https://api.github.com/repos/naggie/dotfiles/issues/120/comments","events_url":"https://api.github.com/repos/naggie/dotfiles/issues/120/events","html_url":"https://github.com/naggie/dotfiles/issues/120","id":290178394,"node_id":"MDU6SXNzdWUyOTAxNzgzOTQ=","number":120,"title":"GPG + Yubikey -- SSH","user":{"login":"naggie","id":208440,"node_id":"MDQ6VXNlcjIwODQ0MA==","avatar_url":"https://avatars2.githubusercontent.com/u/208440?v=4","gravatar_id":"","url":"https://api.github.com/users/naggie","html_url":"https://github.com/naggie","followers_url":"https://api.github.com/users/naggie/followers","following_url":"https://api.github.com/users/naggie/following{/other_user}","gists_url":"https://api.github.com/users/naggie/gists{/gist_id}","starred_url":"https://api.github.com/users/naggie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/naggie/subscriptions","organizations_url":"https://api.github.com/users/naggie/orgs","repos_url":"https://api.github.com/users/naggie/repos","events_url":"https://api.github.com/users/naggie/events{/privacy}","received_events_url":"https://api.github.com/users/naggie/received_events","type":"User","site_admin":false},"labels":[{"id":1114175555,"node_id":"MDU6TGFiZWwxMTE0MTc1NTU1","url":"https://api.github.com/repos/naggie/dotfiles/labels/EPIC","name":"EPIC","color":"26bf49","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-01-20T09:19:22Z","updated_at":"2018-11-11T21:55:09Z","closed_at":null,"author_association":"OWNER","body":"My use cases\r\n* Portable SSH identity (with forwarding)\r\n* Portable GPG identity (with forwarding)\r\n* Use of https://www.passwordstore.org/ sync'd with git\r\n\r\nFuture use cases\r\n* Signing things\r\n* Encrypting things (including email)\r\n* Decrypting things\r\n\r\n-----\r\n\r\n\r\nComprehensive guide: https://github.com/drduh/YubiKey-Guide\r\n\r\nquick guide https://hugotunius.se/2018/07/13/yubikey-ssh-authentication.html\r\n\r\nGood overview of GPG keys and smartcards in general https://gist.github.com/ageis/14adc308087859e199912b4c79c4aaa4\r\n\r\n\r\n- [x] gpg as agent\r\n- [x] ~force console based askpass (if at all, and a non broken version) https://blog.separateconcerns.com/2014-10-24-cli-passwords.html https://unix.stackexchange.com/questions/371901/gpg-agent-refuses-ssh-keys-with-ssh-add-reporting-agent-refused-operation may need update tty pinentry is so very broken (wrong pane, only captures some, should use tmux root tty) could sigstop/cont tmux so pinentry-curses can work.~\r\n- [x] pinentry with ssh is screwed -- wrong tty and mixed I/O -- maybe use gui or gpg forwarded agent instead of ssh agent protocol over the network. Another solution could be to unlock card before ssh (pin cached by yubikey for enture session) fix --  use GUI\r\n- [x] timeout for pinentry (to avoid using an attempt if it's screwed up)\r\n- [x] look into enabling touch to use  https://github.com/drduh/YubiKey-Guide#touch-to-authenticate\r\n- [x] change admin pin codes\r\n- [x] change user pin codes\r\n- [x] decide on key topology\r\n- [x] generate keys\r\n- [x] generate SSH publkey, add to dotfiles add to install-naggie\r\n- [x] generate GPG pubkey (of main key or all?) add to install-naggie\r\n- [x] import both pubkeys to gpg (ultimate trust) with install-naggie\r\n- [x] ~either do the same with stubs, or xfer from card somehow automatically~ stubs not necessary if pubkeys are ultimately trusted -- done via gpg..conf\r\n- [x] update github with ssh/gpg pubkeys\r\n- [x] also forward GPG agent... (needs reliable socket reaping) maybe with a mv to secondary location\r\n- [x] ...enforce github signing of commits\r\n- [x] configure a keyserver maybe http://keys.gnupg.net/ (there is already a sane default)\r\n- [x] stop apple keychain and gnome keychain from getting involved https://wiki.gnupg.org/GnomeKeyring https://blog.josefsson.org/2015/01/02/openpgp-smartcards-and-gnome/\r\n- [x] publish all pubkeys to keyserver\r\n- [x] try on a new PC\r\n- [x] don't start up remote gpg agent (also see what it does when agent forwarding has happened) --- in fact stop it\r\n- [x] key generation script https://www.gnupg.org/documentation/manuals/gnupg/Unattended-GPG-key-generation.html\r\n- [x] install.sh should restart gpg agent to enable new forwarding socket if it's not there (local only)\r\n- [x] gpgagent is run by systemd user service on ubuntu. Kill with fire.\r\n- [x] consider a pre-ssh command to remove the socket, kill gpg, find socket path. May help make work with non-configured server.\r\n- [x] agent forwarding security mitigation -- touch to allow, explicit ssh command (gssh) or something\r\n- [x] sort out issues with gpg2 vs gpg2 ubuntu 16.04\r\n- [x] work around possible bug -- see section on sleepwalker https://evilmartians.com/chronicles/stick-with-security-yubikey-ssh-gnupg-macos (I did not experience said bug)\r\n- [ ] support gssh chaining (command that calls func or something)\r\n- [ ] install ykman on all platforms  https://github.com/Yubico/yubikey-manager\r\n- [ ] wire up https://github.com/maximbaz/yubikey-touch-detector or equivalent to a notification and/or sound?\r\n- [ ] --card-status required to initallly discover card's secret keys (and bind card to stub)\r\n- [ ] set up guide (with recommendation for touch settings)"},"comment":{"url":"https://api.github.com/repos/naggie/dotfiles/issues/comments/437708604","html_url":"https://github.com/naggie/dotfiles/issues/120#issuecomment-437708604","issue_url":"https://api.github.com/repos/naggie/dotfiles/issues/120","id":437708604,"node_id":"MDEyOklzc3VlQ29tbWVudDQzNzcwODYwNA==","user":{"login":"mafredri","id":147409,"node_id":"MDQ6VXNlcjE0NzQwOQ==","avatar_url":"https://avatars2.githubusercontent.com/u/147409?v=4","gravatar_id":"","url":"https://api.github.com/users/mafredri","html_url":"https://github.com/mafredri","followers_url":"https://api.github.com/users/mafredri/followers","following_url":"https://api.github.com/users/mafredri/following{/other_user}","gists_url":"https://api.github.com/users/mafredri/gists{/gist_id}","starred_url":"https://api.github.com/users/mafredri/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mafredri/subscriptions","organizations_url":"https://api.github.com/users/mafredri/orgs","repos_url":"https://api.github.com/users/mafredri/repos","events_url":"https://api.github.com/users/mafredri/events{/privacy}","received_events_url":"https://api.github.com/users/mafredri/received_events","type":"User","site_admin":false},"created_at":"2018-11-11T21:55:09Z","updated_at":"2018-11-11T21:55:09Z","author_association":"NONE","body":"Saw this issue linked from the one about Pinentry in Pure, thought I'd let you know I'm working on something that might interest you, [gpg-notify](https://github.com/mafredri/gpg-notify), still very early days though. Mostly a POC stage atm. It works via parsing `gpg-agent` logs (and working on parsing `scdaemon` as well for more exact results).\r\n\r\nWhen I started using gpg and YubiKeys I noticed I needed more information about what's going on, so it notifies about smartcard events. It also tries to look up what processes have initiated the communication with gpg-agent and gives information about them (although atm I think it just logs most of it to the terminal). Im also planning on showing what processes generally have initiated pinentry, etc."}}
{"actor":{"display_login":"mafredri"}}