Run command (to create dir) before SSH tries to link socket given in RemoteForward

user_211404 0
Viewed 182

I'm currently trying to set up GnuPG Agent Forwarding via SSH. Since I set GNUPGHOME="$XDG_DATA_HOME/gnupg" on both the local and the remote system, I'm not using the default GPG sockets paths, but instead have configured the following in my ~/.ssh/config:

Host myhost
    HostName 1.2.3.4
    User myuser
    ForwardAgent yes
    RemoteForward /run/user/1000/gnupg/d.fj15x7xb73ergseatdpnwdt7/S.gpg-agent /run/user/1000/gnupg/d.fj15x7xb73ergseatdpnwdt7/S.gpg-agent.extra

The problem with this configuration is, that on the first connection the remote parent directory /run/user/1000/gnupg/d.fj15x7xb73ergseatdpnwdt7/ does not yet exists, so the RemoteForward fails with the following:

Warning: remote port forwarding failed for listen path /run/user/1000/gnupg/d.fj15x7xb73ergseatdpnwdt7/S.gpg-agent

The correct way to create that directory would be to run gpgconf --create-socketdir (which is a no-op if the directory exists). However, when I put this into my .bashrc it only seems gets executed after SSH tries to forward the socket specified in RemoteForward. That is, the socket is only created when establishing a second SSH connection:

$ ssh myhost
Warning: remote port forwarding failed for listen path /run/user/1000/gnupg/d.fj15x7xb73ergseatdpnwdt7/S.gpg-agent
[myuser@myhost ~]$ # Socket not correctly forward, but directory has been created now.
[myuser@myhost ~]$ logout
$ ssh myhost
[myuser@myhost ~]$ # Socket correctly forward on second attempt.

So my question is: how can I run a command (in this case gpgconf --create-socketdir) or at least create a directory (in this case /run/user/1000/gnupg/d.fj15x7xb73ergseatdpnwdt7/) before SSH attempts to link a socket specified in RemoteForward?

My only guess here was to put the command into ~/.bashrc but that seems to be executed to late.

gpg-agent gnupg ssh
1 Answers

Yes, this is a bug, and GnuPG's documentation that you cite fails to note the problem.

I worked around this with a systemd user service that I added to remote systems I wanted to forward my gpg agent's socket to. I attempted to contribute it to GnuPG in https://dev.gnupg.org/D435 but there is some disagreement over who should be responsible for creating the directory the socket is in.

It's extremely frustrating.

user_7654660
Related