Two work sites, site 1 and site 2. Two Linux servers, server A and server B. Server A is reachable from both sites, while server B is reachable from site 1 only. Two Windows workstations, one at site 1, the other at site 2.
I'm on Windows at site 1, using PuTTY to connect to server A that's set to ssh publickey authentication only.
I use gpg-agent with the
enable-putty-support setting activated instead of pageant to use a smartcard for git authentication at
Most of the time at site 1, I need to remotely connect to server B using NoMachine's NX Client v3.5.x. From there, I need to be able to ssh into server A using publickey authentication as well. Since server B is running NX Server v3.5.x, agent-forwarding does not work using NX Client. Thus, with the smartcard unavailable, I have to make sure I have a private key available on server B.
Therefore, I created a password-protected RSA ssh key pair with on server B using
ssh-keygen -t rsa
The password is
verylongandcomplicatedpassword. Thus, I don't want to type it a lot.
I appended the public key
.ssh/authorized_keys on server A as well as on server B. Using ssh from server B to server A works now. Vice-versa also works now.
On Windows at site 1 I have a PuTTY connection set-up to server B using agent-forwarding for my smartcard in order to be able to use git on server B and authenticate with my smartcard.
I want the same thing for server A, because server B is unreachable from site 2, where I also work sometimes.
gpg-agent is started as a Startup item using
gpg-connect-agent /bye and is running on Windows.
scp'd the private key
.ssh/id_rsa from server B onto my Windows machine. I successfully opened it with PuTTYgen and saved it in PuTTY format to
I created a new PuTTY connection to server A, connection type
Connection --> SSH --> Auth --> [Check] Attempt Authentication using Pageant [Uncheck] Attempt "keyboard-interactive" auth [Check] Allow agent forwarding Private Key File for Authentication: C:\Users\name\ssh\id_rsa.ppk
This sort of works. However, PuTTY itself -- not
gpg-agent -- prompts me for the password
verylongandcomplicatedpassword -- every time! Agent forwarding also doesn't work insomuch as that I'm unable to go from server A to server B without retyping my password after successful login from PuTTY.
I think PuTTY is unable to add the key to
gpg-agent or communicate with it properly despite
enable-putty-support being activated in the
gpg-agent configuration and
gpg-agent working like a champ for git and agent-forwaring working for git on server B at site 1.
What I tried
Thinking I'm extremely clever, I began to look into how to convert my
.ssh/id_rsa to a format I can use in gpg2 for
gpg-agent. This Google search yielded mostly bullshit results.
The best of which -- because it actually sort of mentions a way to convert the key -- is over here.
OpenSSH to GnuPG S/MIME
First we need to create a certificate (self-signed) for our ssh key:
openssl req -new -x509 -key ~/.ssh/id_rsa -out ssh-cert.pem
We can now import it in GnuPG
openssl pkcs12 -export -in ssh-certs.pem -inkey ~/.ssh/id_rsa -out ssh-key.p12 gpgsm --import ssh-key.p12
Notice you cannot import/export DSA ssh keys to/from GnuPG
Said and done. Notice obvious typo in second command (ssh-certs.pem vs ssh-cert.pem). I did all
openssl commands on server B, then copied the
ssh-key.p12 file over to Windows and imported it into gpg. I can see the key as X.509 in Kleopatra, a graphical frontend for gpg on Windows.
However, despite this, nothing changed and nothing seems to be working. I tried with the original PuTTY settings above. The behavior is unchanged.
Private Key File for Authentication field empty, I get the usual message:
PuTTY Fatal Error Disconnected: No supported authentication methods available (server sent: publickey)
I'm ignorant as to why this isn't working. Is GnuPG S/MIME or X.509 not what I need? I tried converting the
.ssh/id_rsa.pub as well, thinking it might be a public key issue, but
openssl complains that it only wants to convert private keys.
What I don't need
- I'm stupid for wanting this
- nobody would never ever need to want to do this
- if I don't like how ssh/gpg/PuTTY works, I can code my own
- man gpg, man ssh, man ssh_config