<?xml version="1.0" encoding="UTF-8"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en-gb">
<link rel="self" type="application/atom+xml" href="https://forum.yubico.com/feed.php?f=26&amp;t=1889" />

<title>Yubico Forum</title>
<subtitle>...visit our web-store at</subtitle>
<link href="https://forum.yubico.com/index.php" />
<updated>2015-05-26T20:47:09+01:00</updated>

<author><name><![CDATA[Yubico Forum]]></name></author>
<id>https://forum.yubico.com/feed.php?f=26&amp;t=1889</id>
<entry>
<author><name><![CDATA[zviratko]]></name></author>
<updated>2015-05-26T20:47:09+01:00</updated>
<published>2015-05-26T20:47:09+01:00</published>
<id>https://forum.yubico.com/viewtopic.php?t=1889&amp;p=7357#p7357</id>
<link href="https://forum.yubico.com/viewtopic.php?t=1889&amp;p=7357#p7357"/>
<title type="html"><![CDATA[Re: Using GPG SSH authentication from TTY]]></title>

<content type="html" xml:base="https://forum.yubico.com/viewtopic.php?t=1889&amp;p=7357#p7357"><![CDATA[
If I understand it correctly you switch to a physical console instead of using a terminal in X?<br /><br />Typically if ssh-agent needs your input it starts an app that asks for PIN, and this app shows up on $DISPLAY. The $DISPLAY it shows on is inherited from the ssh-agent process when it is started. The same goes for gpg-agent.<br />I am actually not sure if ssh-agent/gpg-agent has to be the one starting pinentry, ssh-add certainly works and asks for passphrase inline, but I guess this is your problem - on a physical TTY there is no way to pop up a window to enter your PIN (it might actually be showing on the original $DISPLAY if it's running). You could get around this by either adding the key with ssh-add (not sure how that plays with gpg-agent on Ubuntu), using a PKCS#11 provider directly with ssh (ssh -I /path/to/lib.so) - again not sure how that works with GPG keys, there's probably no PKCS#11 provider for that? Or you can enter PIN while running X and if caching is enabled it will work for some time afterwards without asking.<br /><br />Another possibility (and a strong one) is that you don't actually have ssh-agent available in TTY - X session sets up the environment including SSH_AGENT_SOCK for you, in TTY you need to use something like &quot;keychain&quot; or a different mechanism (everybody has his own script I guess) to set that up.<br /><br />You can verify that ssh-agent is available by running &quot;echo $SSH_AUTH_SOCK&quot; in the TTY, if it is set then try talking to ssh-agent with &quot;ssh-add -L&quot;. Try adding an encrypted private key (generate one) and see how it asks for PIN...<br /><br />I haven't used Ubuntu on desktop for quite some time, but I think they used gnome-keyring as an ssh-agent - does it handle gpg too nowadays? I don't know...<p>Statistics: Posted by <a href="https://forum.yubico.com/memberlist.php?mode=viewprofile&amp;u=3463">zviratko</a> — Tue May 26, 2015 8:47 pm</p><hr />
]]></content>
</entry>
<entry>
<author><name><![CDATA[mfaine]]></name></author>
<updated>2015-05-24T06:12:36+01:00</updated>
<published>2015-05-24T06:12:36+01:00</published>
<id>https://forum.yubico.com/viewtopic.php?t=1889&amp;p=7348#p7348</id>
<link href="https://forum.yubico.com/viewtopic.php?t=1889&amp;p=7348#p7348"/>
<title type="html"><![CDATA[Using GPG SSH authentication from TTY]]></title>

<content type="html" xml:base="https://forum.yubico.com/viewtopic.php?t=1889&amp;p=7348#p7348"><![CDATA[
This may be more of an Ubuntu/GPG question than a Yubikey question but while on the desktop connecting via SSH to my NAS prompts me for my pin and everything works just fine but when I switch to a TTY and try connecting I'm only presented with password as an option.   Can anyone confirm that it's just my setup, and/or provide solutions or suggestions for diagnosing the cause?<p>Statistics: Posted by <a href="https://forum.yubico.com/memberlist.php?mode=viewprofile&amp;u=1935">mfaine</a> — Sun May 24, 2015 6:12 am</p><hr />
]]></content>
</entry>
</feed>