2

Scenario

Two work sites, site 1 and site 2. Two Linux servers, server A and server B. Server A is reachable from both sites, while server B is reachable from site 1 only. Two Windows workstations, one at site 1, the other at site 2.

I'm on Windows at site 1, using PuTTY to connect to server A that's set to ssh publickey authentication only.

I use gpg-agent with the enable-putty-support setting activated instead of pageant to use a smartcard for git authentication at $popular_git_site.

Most of the time at site 1, I need to remotely connect to server B using NoMachine's NX Client v3.5.x. From there, I need to be able to ssh into server A using publickey authentication as well. Since server B is running NX Server v3.5.x, agent-forwarding does not work using NX Client. Thus, with the smartcard unavailable, I have to make sure I have a private key available on server B.

Therefore, I created a password-protected RSA ssh key pair with on server B using

 ssh-keygen -t rsa

The password is verylongandcomplicatedpassword. Thus, I don't want to type it a lot.

I appended the public key .ssh/id_rsa.pub to .ssh/authorized_keys on server A as well as on server B. Using ssh from server B to server A works now. Vice-versa also works now.

Problem

On Windows at site 1 I have a PuTTY connection set-up to server B using agent-forwarding for my smartcard in order to be able to use git on server B and authenticate with my smartcard.

I want the same thing for server A, because server B is unreachable from site 2, where I also work sometimes. gpg-agent is started as a Startup item using gpg-connect-agent /bye and is running on Windows.

Thus, I scp'd the private key .ssh/id_rsa from server B onto my Windows machine. I successfully opened it with PuTTYgen and saved it in PuTTY format to C:\Users\name\ssh\id_rsa.ppk.

I created a new PuTTY connection to server A, connection type SSH.

Connection --> SSH --> Auth -->
    [Check]   Attempt Authentication using Pageant
    [Uncheck] Attempt "keyboard-interactive" auth
    [Check]   Allow agent forwarding
    Private Key File for Authentication: C:\Users\name\ssh\id_rsa.ppk

This sort of works. However, PuTTY itself -- not gpg-agent -- prompts me for the password verylongandcomplicatedpassword -- every time! Agent forwarding also doesn't work insomuch as that I'm unable to go from server A to server B without retyping my password after successful login from PuTTY.

I think PuTTY is unable to add the key to gpg-agent or communicate with it properly despite enable-putty-support being activated in the gpg-agent configuration and gpg-agent working like a champ for git and agent-forwaring working for git on server B at site 1.

What I tried

Thinking I'm extremely clever, I began to look into how to convert my .ssh/id_rsa to a format I can use in gpg2 for gpg-agent. This Google search yielded mostly bullshit results.

The best of which -- because it actually sort of mentions a way to convert the key -- is over here.

OpenSSH to GnuPG S/MIME

First we need to create a certificate (self-signed) for our ssh key:

openssl req -new -x509 -key ~/.ssh/id_rsa -out ssh-cert.pem

We can now import it in GnuPG

openssl pkcs12 -export -in ssh-certs.pem -inkey ~/.ssh/id_rsa -out ssh-key.p12
gpgsm --import ssh-key.p12

Notice you cannot import/export DSA ssh keys to/from GnuPG

Said and done. Notice obvious typo in second command (ssh-certs.pem vs ssh-cert.pem). I did all openssl commands on server B, then copied the ssh-key.p12 file over to Windows and imported it into gpg. I can see the key as X.509 in Kleopatra, a graphical frontend for gpg on Windows.

However, despite this, nothing changed and nothing seems to be working. I tried with the original PuTTY settings above. The behavior is unchanged.

Leaving the Private Key File for Authentication field empty, I get the usual message:

PuTTY Fatal Error Disconnected: No supported authentication methods available (server sent: publickey)

I'm ignorant as to why this isn't working. Is GnuPG S/MIME or X.509 not what I need? I tried converting the .ssh/id_rsa.pub as well, thinking it might be a public key issue, but openssl complains that it only wants to convert private keys.

What I don't need

Answers suggesting

  • I'm stupid for wanting this
  • nobody would never ever need to want to do this
  • if I don't like how ssh/gpg/PuTTY works, I can code my own
  • man gpg, man ssh, man ssh_config

closed as off-topic by schroeder, Xander, Stephane, Steve, Iszi Jun 18 '15 at 16:36

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Xander, Stephane, Iszi
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Keys imported using gpgsm still are X.509 keys and stored in a different keyring than OpenPGP keys. Importing an X.509 key in GnuPG using gpgsm does not make it an OpenPGP key. – Jens Erat Jun 17 '15 at 8:43
  • @JensErat I'm aware of this. I wasn't aware whether X.509 precludes me from using the cert for authentication. Apparently, it does. – FRob Jun 17 '15 at 14:59

Browse other questions tagged or ask your own question.