Use the gpg-agent for initial ssh socket support

[colemickens]

Hi! I've just discovered that I can use gpg-bridge along with wsl-ssh-pageant to forward SSH+GPG sockets to a remote machine and perform SSH+GPG operations.

Is it possible for gpg-bridge to expose the extra+ssh sockets, so that I could potentially use gpg-bridge without needing to use wsl-ssh-pageant?

Thanks! This tool is a life-saver. So far it's the only way to forward GPG sockets without WSL1/2, and it's a nice little Rust binary at the end.

[colemickens]

reading through this makes it sound like the S.gpg-agent.ssh socket is special in Windows and handled differently than the extra gpg socket, so maybe I just need to continue using both tools until https://dev.gnupg.org/T3883 is fixed.

[colemickens]

(selfishly, I'd love a tool that could do both with just one background service to setup)

[BusyJay]

along with wsl-ssh-pageant to forward SSH+GPG sockets to a remote machine and perform SSH+GPG operations.

Can you explain more on that? Like forward ssh from wsl to remote? Or something else?

I can forward the ssh agent to remote by using the native windows ssh client by simply configuring ForwardAgent yes to yes. What needs to be done is making sure the ssh-agent service that comes from the client are started.

[colemickens]

I use gpg-agent as my ssh-socket provider. As far as I know native `ssh.exe` can not use gpg-agent's `S.gpg-agent.ssh` socket. So, `wsl-ssh-pageant` exposes a named pipe that internally adapts to and connects to that socket. Then, I set `SSH_AUTH_SOCK` to that named pipe and then use `ssh -A ...` to forward like normal. But that's only for the SSH socket of course.

…

On Thu, Jan 7, 2021, 20:18 Jay ***@***.***> wrote: along with wsl-ssh-pageant to forward SSH+GPG sockets to a remote machine and perform SSH+GPG operations. Can you explain more on that? Like forward ssh from wsl to remote? Or something else? I can forward the ssh agent to remote by using the native windows ssh client by simply configuring ForwardAgent yes to yes. What needs to be done is making sure the ssh-agent service that comes from the client are started. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#2 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AACP25AGLW3ES5HC6OABMH3SY2BSVANCNFSM4VZ2NCNA> .

[colemickens]

This post contains details about the exact setup I'm using now: PowerShell/Win32-OpenSSH#827 (comment)

[BusyJay]

I see. I can give it a try these weekend and see whether it works. What need to be done are to support name pipe and cygwin compatible socket.

If you are in a hurry, contributions are also welcome.

[BusyJay]

Waiting for tokio-rs/tokio#3388.

[colemickens]

One thing I've noticed - however gpg-bridge is backgrounding itself, it manages to entirely disappear from Task Manager and then I don't know if it is running or not. (Process Explorer sees it, though.)

[BusyJay]

Windows will create a blank terminal window for console program, gpg-bridge uses some trick to get around the issue, the side effect is it will not be shown up in Task Manager. There are two solutions for the problem, one is to implement it as Windows Service instead, the other is to use a systray as #4 describes.

[colemickens]

Looks like this is unblocked: tokio-rs/tokio#3760

EDIT: just wanted to say thanks again for this, I use it almost every day.

[BusyJay]

Glad it helps! I may check it at weekends.

[BusyJay]

I can read bytes from named pipe now, but I can't make gnupg ssh socket to accept requests. I may need more time on this.

[BusyJay]

I pushed my changes. The script has been largely updated, including changes to command line arguments to support new ssh forwarding. See README for how to use the tool.

I have tested locally to make sure ssh forwarding work, but if you find any problem, don't hesitate to report.

[colemickens]

It seems like it's working well when I use this:

.\gpg-bridge.exe --extra 127.0.0.1:4321 --ssh \\.\pipe\gpg-bridge-ssh

If I use this instead, it went into some awful loop spawning itself over and over trying to spawn the detached window it looked like.

.\gpg-bridge.exe --detach --extra 127.0.0.1:4321 --ssh \\.\pipe\gpg-bridge-ssh

[colemickens]

Also, thank you x1000. This is quite slick.