3

I am using gnupg 1.4.15

ls ~/.cache/keyring-* shows many keyring directories.

GPG_AGENT_INFO variable is pointing only to the latest one.

Should I manually delete all the other keyring agents? Is it a security risk to have all those keyring directories remaining in ~/.cache/ ?

Also, what is the correct procedure to clear/stop the keyring agent and thereby make it forget all the passphrases it is remembering.

1

A GPG_AGENT is a program that when asked, (de|en)crypts the data for the caller (in this case using gpg). The 'files' you see are most probably sockets for communicating with the agent.

Once the program is closed (or locked), it can't be used, those files don't contain any private information, agents are (generally) pretty-well designed, and won't even store private material out of ram (in most cases, the OS may not allow memory locking, or if you hibernate the computer, the keys can go into disk).

In regards to your question

Also, what is the correct procedure to clear/stop the keyring agent and thereby make it forget all the passphrases it is remembering.

You don't specify which agent you are using, the basic approach is to kill the agent process, but it will probably support unloading the keys / being put into locked state. See also How to lock a unlocked GNOME Keyring?

¹ See if the first mode character is s, eg.

srw------- 1 indiajoe indiajoe 0 jun 8 21:57 agent.1234

  • Thank you. I tried the fuser command fuser -a ~/.cache/keyring-xxxx/*, and looked up the PID of the process which was using those sockets. It turned out to be "gnome-keyring-daemon --start". So I guess, I only have to stop it. – indiajoe Jun 8 '15 at 23:14
  • I do hibernate my machine ones in a while. So is it recommended to always stop the gpg-agent before hibernating, to prevent the keys being written into harddisk? – indiajoe Jun 8 '15 at 23:16
  • 1
    Stopping gnome-keyring-daemon will work, yes. It should lock when you hibernate (so no secret is exposed), but a quick search doesn't show a reference supporting it, the most similar is launchpad 255228. – Ángel Jun 8 '15 at 23:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.