I'm trying to run gpg from a Bash script designed to backup a website. The command that fails is
gpg --homedir /home/backupuser/.gnupg --verbose --no-tty --recipient {group-name} --trust-model always --output /home/backupuser/backup/{tar-file}.gpg --encrypt /mnt/ramdir/site-backup-backupuser/{tar-file}
It fails with return code 127. The gpg home directory exists, as does the {tar-file}. The output directory exists but the output file does not.
If I repeat the gpg command in the script it fails in exactly the same way. But if I execute it in shell immediately after it has failed in the script it works as expected. The output is:
gpg: using subkey {hhhhhhhhhhhhhhhh} instead of primary key {hhhhhhhhhhhhhhhh}
gpg: automatically retrieved '{email address1}' via Local
gpg: No trust check due to '--trust-model always' option
gpg: using subkey {hhhhhhhhhhhhhhhh} instead of primary key {hhhhhhhhhhhhhhhh}
gpg: automatically retrieved '{email address2}' via Local
gpg: No trust check due to '--trust-model always' option
gpg: reading from '/mnt/ramdir/site-backup-backupuser/{tar-file}'
gpg: writing to '/home/backupuser/backup/{tar-file}.gpg'
gpg: '/mnt/ramdir/site-backup-backupuser/{tar-file}' already compressed
gpg: RSA/AES256 encrypted for: "{hhhhhhhhhhhhhhhh} {Comment} <{email address1}>"
gpg: RSA/AES256 encrypted for: "{hhhhhhhhhhhhhhhh} {Comment} <{email address2}>"
This is Debian "bullseye" 11.6, gpg 2.2.27 and libgcrypt 1.8.8.
I have tried numerous combinations of parameters, always with the above result. With or without --homedir, with or without sudo (I was getting desperate), from a file on disk rather than in RAM, with or without --verbose and several others.
Related
I am trying to get a better understanding of what is going on with gpg.
If you have a file and sign it: gpg --sign file.txt
you can verify it with: gpg --verify file.txt.gpg
when you get a successful output: gpg: Signature made...
But when you sign AND encrypt a file: gpg --encrypt --sign -r test#email.com file.txt
and then run --verify on the encrypted file I get: gpg: verify signatures failed: Unexpected error
I know that I can just call --decrypt on the file and it will verify and decrypt it, but what if I want to verify only?
I figured out the answer to this and then some. So I am going to add some additional information for clarity.
First of all, I realize based on the last line to this answer that gpg uses SIGN THEN ENCRYPT. Which means calling --verify or any variation to verify on an encrypted file will just output gpg: verify signatures failed: Unexpected error. This happens because the signature is "hidden" in encryption, so when you try to call --verify on the file, it will not see a signature.
Secondly, the --decrypt flag will both decrypt the file AND if the file is signed, verify it too.
Here is what --decrypt is doing. It looks at your default secret keyring secring.kbx in ~/.gnupg to use a secret key for decrypting the file. Then after it is decrypted, it looks at your default public keyring pubring.kbx in the folder ~/.gnupg and tries to verify the signature on the file, if it has one.
If it has no signature, it will just decrypt the file.
If it has a signature, but you don't have the public key, it will decrypt the file but it will fail to verify the signature.
If it has a signature and you have the public key, it will decrypt and verify.
With that said, there is no reason to verify a signed file BEFORE decrypting it.
Thirdly, as an added bonus, you can also specify a keyring you want to use for decrypting and verification. Say you want to use a temporary keyring to verify signatures or for what ever reason you want a temporary keyring to decrypt the message too.
You can specify the keyrings for --decrypt to use with the following command:
gpg --secret-keyring path/to/temp/secring.kbx --keyring path/to/temp/pubring.kbx --decrypt file.txt.gpg
This command will look for the secret ring and public ring at the specified paths in order to use those rings for decryption and verification instead of the default rings found in ~/.gnupg. Want to use a default ring with a temp ring? Just omit the flag and path to the ring you want defaulted.
All in all, for encrypted and signed files, if you want to decrypt and verify that file, you need to make sure that the private key for decryption is in your secret keyring and the public key for verification is in your public keyring.
One thing to understand about GPG encrypt & sign, which isn't very well explained, is that the signature can only be verified by the recipient.
Suppose Alice encrypts a file to send to Bob. She will encrypt with Bob's public key, and sign with her private key.
gpg --output encrypted.gpg --recipient B0B0000000000000000000000000000000000000 --armor --sign --default-key A11CE00000000000000000000000000000000000 --encrypt file-to-encrypt.txt
There's no way now for Alice, or anyone who does not have Bob's private key, to verify the signature.
Now Bob will decrypt the file. If it is signed, he'll see information about the signature in the output:
$ gpg --decrypt encrypted.gpg > decrypted.txt
gpg: encrypted with 2048-bit RSA key, ID D83A4C12B3840EBA, created 2020-09-24
"Alice <alice#example.com>"
gpg: Signature made 09/28/20 13:16:47 Eastern Daylight Time
gpg: using RSA key A11CE00000000000000000000000000000000000
gpg: Good signature from "Alice <alice#example.com>" [ultimate]
Note the Signature made and Good signature lines in the output.
$ gpg --encrypt --sign -r test#email.com file.txt
After file.txt.gpg generated, try the command below:
$ gpg -d file.txt.gpg
or just execute:
$ gpg file.txt.gpg
When I try to list my gpg keys I'm getting an error:
gpg --list-keys
gpg: NOTE: trustdb not writable
gpg: checking the trustdb
gpg: trustdb rec 56: write failed (n=-1): Bad file descriptor
gpg: trustdb: sync failed: Bad file descriptor
I tried doing a recursive chown on my user directory. But that didn't seem to solve the problem.
The volume is not read only:
[web1:~] bluethundr% touch test
[web1:~] bluethundr% echo hi > test
[web1:~] bluethundr% cat test
hi
So I'm wondering why the trustdb is not writable.
How can I solve this?
That seems to have been reported in bug 771976
I found this when running the command apt-key list on a machine where
the root filesystem is normally mounted read-only.
This results in running gpg with "--trustdb-name", "/etc/apt//trustdb.gpg", "--list-keys".
gpg in turn attempts to create "/etc/apt//trustdb.gpg.lock" in order to lock the trustdb, which fails.
Seeing how --list-keys is an operation which shouldn't require writing
to anything, having it fail in this situation is bad.
Even though the volume is not read-only, check (with an strace) where gpg --list-key is attempting to create its trustdb.gpg.lock file.
strace gpg --list-key | grep trustdb.gpg.lock
The OP bluethundr adds in the comments:
I changed to the .gnupg directory and did a list.
I saw that the files in there were owned by root! So I did a sudo chown -R myuser:myuser *.
Then I ran gpg --list-keys again and it worked!
The problem was that the files in .gnupg were owned by root for some reason.
I granted the permissions on the trustdb.gpg file present in the installation directory in C Drive, to the user I had logged on with. It worked thereafter.
I'm trying to decrypt a file using gpg and getting this error:
$ gpg --no-tty --batch --verbose --decrypt --passphrase foo file.enc
Version: GnuPG v1.4.11 (GNU/Linux)
gpg: armor header:
gpg: CAST5 encrypted data
gpg: encrypted with 1 passphrase
gpg: decryption failed: Bad session key
I tried to reload the gpg agent, no luck:
$ gpgconf --reload gpg-agent
How to solve that?
For the record, if somebody will encounter this problem, too:
The problem was, that the encryption was done using gpg version 1.4.11 and the decryption was using gpg version 2.0.22.
After upgrading the encryption to gpg2 (2.0.17), everything worked fine.
I found this, which seems to be the magic that I could not find anywhere else:
Try adding --pinentry-mode loopback to your command. Maybe there is a
problem with your installation / pinentry program so that it does not start or
you are accidentally using a dummy / test pinentry which provides the wrong
passphrase.
I encrypted my file with a passphrase file in batch mode. When I tried to decrypt my file I got the dreaded "bad session key" message.
I created a passphrase file with Vim for Windows, and Vim left \r\n at the end of the text line even though I did not hit carriage return. gpg ignored the \n but retained the \r as part of the passphrase!
Vim for Windows can be induced to not leave \r\n, but it is easier to just use Notepad without a carriage return at the end of line. Best to check your passphrase file with a hexdump to be sure. There are other ways to get hurt by \r\n issues when supplying the passphrase using the command line, so be alert to it.
I try to decrypt file using following command:
gpg --batch --no-tty --yes --always-trust --primary-keyring /root/.gnupg/secring.gpg -o file.csv --passphrase -d file.csv.asc
It work fine, But when I run it in cron I get following error message:
gpg: expected public key but found secret key - must stop
What can I do to get it running in cron?
Don't point to a keyring, but a complete GnuPG home directory using --homedir /root/.gnupg. --homedir sets the directory GnuPG is searching all other files inside.
--primary-keyring file can only be used for public keyrings, which will not help you with decryption. From man gpg:
--primary-keyring file
Designate file as the primary public keyring. This means that newly
imported keys (via --import or keyserver --recv-from) will go to this
keyring.
Alternatively, you can use --secret-keyring file:
--secret-keyring file
Same as --keyring but for the secret keyrings.
I'm not sure whether you need this parameter anyway: if you're running this cron job as root user, $HOME should already be set to /root and GnuPG will find its home folder without further configuration. If you're not running the cron job as root, put the keys in another location (ie., the user's home directory); giving other users read- and possibly write access to /root is a potential security issue.
How can I pipe the passphrase and encrypted file in gpg.exe?
I have tried a few different combinations but I can't get it to work.
Here is my attempt,
C:\>gpg.exe --output [OUTPUT_FILE] --batch --passphrase-fd 0 --decrypt < [INPUT_FILE] < [PASSPHRASE_FILE]
from this I get error
gpg: decrypt_message failed: eof
Swapping the input and passphrase around I get the error
gpg: no valid OpenPGP data found.
gpg: decrypt_message failed: eof
If I don't try and send the encrypted file via stdin then the decryption works fine.
Ultimately what I want to do is decrypt a file based on a file mask with the date timestamp in the file name. Outlined below,
C:\>gpg.exe --output yyyyMMdd.csv --batch --passphrase-fd 0 --decrypt < *_yyyyMMdd_*.txt < [PASSPHRASE_FILE]
I'm not sure if this will work because I can't get the basic scenario working, I would also appreciate if someone could advise me of the best way to achieve this.
Don't use redirection for the file you want to decrypt, only for the file containing your passphrase:
C:\>gpg.exe --output [OUTPUT_FILE] --batch --passphrase-fd 0 --decrypt [INPUT_FILE] < [PASSPHRASE_FILE]
But honestly, it might be easier for you to remove the passphrase from your key. After all, storing your passphrase in a file is not very secure. Just change your passphrase to a blank and protect your gpg home directory to deny access to any process other than your own.