gpg-agent compatibility

[prognaest]

Hello and hi,

I am wondering if your pageant is capable of dealing with putty-enabled gpg-agents? I have a smartcard and would like to use it on windows as well. gpg and ssh on Debian is working fine, but I don't seem to be able to have it work on Windows, too. I installed winssh-pageant via winget and ran it as wingssh-pageant.exe --sshpipe \\.\pipe\openssh-ssh-agent

gpg-agent is running. But connecting to a host with ssh username@host in PowerShell only throws Permission denied (publickey) and doesn't pop up the notification to confirm from gpg-agent.

Looking forward using it!

PS: I hope this is fine, I assumed that this isn't an issue, but rather a question due to my stupidity 😁

[ndbeals]

Which gpg-agent are you using? can you link me? I'm trying to understand this all better.

The part about you connecting to a host with ssh in powershell, that wouldn't use winssh-pageant at all, that's just ssh -> ssh-agent.

[ndbeals]

To answer your question directly, this tool should support anything the ssh-agent it's talking to supports. All it does is receive a binary message and forward that message to a different place, it's up to the applications on both ends to do it correctly.

[prognaest]

I want to thank you for your answer. I couldn't get it to work as I intended, so I switched to a Unix based system where it is natively supported. A friend of mine got it to work though, so I guess it's more a user problem ^^"

[andrewmgee]

@ndbeals experienced same issue with GPG 2.40.0 and Gpg4Win 4.1.0.

Doesn't seem to work concurrently with winssh-pageant, if I close the winssh-pageant process then the gpg-agent works as expected.

[ndbeals]

I expand on that, enable-putty-support inside gpg and winssh-pageant are mutually exclusive. You can only use one or the other because of how pageant works.

Both tools are trying to create a special window named "Pageant" and only one of those windows can exist. It's the same reason you're having this issue: masahide/OmniSSHAgent#31

If you'd like help working out a setup that you desire, I can do so.

[andrewmgee]

correct with the below gpg-agent.conf:

enable-putty-support
enable-ssh-support

I figured that is what is happening, since both are trying to use "pageant".

I tried various configurations, in one the gpg-agent would blink the yubikey so it seemed like it started to do something, but then would end immediately in an auth error. I'd have to try again exactly what configuration I tried and can paste the exact error.

Any help would be appreciated, if you think it could be possible to make it work.

[ndbeals]

I'm happy to help but I need to better understand what is your goal here? As in, what is the behaviour you want to see?

Keep in mind that GPG itself is an ssh agent. and Microsoft OpenSSH package also provides its own ssh agent. It appears to me that you're trying to run two separate ssh-agents at once.

[andrewmgee]

End goal would be to be able to authenticate with ssh keys from both the Yubikey and 1password.

The other configuration which I mentioned before which I tried with slightly different results was with the below gpg-agent config, essentially disabling the pageant in the gpg agent and instead enabling openssh.

enable-ssh-support
enable-win32-openssh-support

It results in the below, which gets further than the enable-putty-support:

Authenticating with public key "cardno: 123456" from agent
Agent failed to provide a signature

[ndbeals]

I think your solution is to not run winssh-pageant at all.

run gpg-agent with

enable-putty-support
enable-ssh-support
enable-win32-openssh-support

and that should do it for you. Winssh-pageant has no purpose in the setup you've explained. gpg-agent already does putty support.

You cannot run two ssh-agents at the same time (well you can, but it's useless). SSH clients can only talk to one agent. This means you cannot run gpg-agent with enable-ssh-support and 1password (with ssh agent turned on) at the same time, you must pick one or the other.