Contents
|
Jun 22, 2016 Apt is a dpkg management tool used by Debian and its offpsring, particularly Ubuntu and Linux Mint. CentOS is from the RHEL/Fedora side of the Linux family tree and uses yum (and dnf nowadays). Making a simple, signed apt repository on centos (or manually, on any system really) is possible. This is how to do it. Building an apt repository. Apt-key adv -fetch-keys will only fetch one key from the URL, and if the URL contains multiple keys, please use wget apt-key add instead. – Tao Wang Oct 27 '17 at 5:11 It seems to work with https already (just tested on Ubuntu 17.10) – user1182474 Dec 9 '18 at 19:25.
'GnuPG uses public-key cryptography so that users may communicate securely. In a public-key system, each user has a pair of keys consisting of a private key and a public key. A user's private key is kept secret; it need never be revealed. The public key may be given to anyone with whom the user wants to communicate.' From The GNU Privacy Handbook
This page describes how to use OpenPGP keys. For a brief description of what OpenPGP is see the next section. The package gnupg (including the command gpg) is installed on all Ubuntu systems. The package description says in part: 'GnuPG 1.4 is the standalone, non-modularized series. In contrast to the version 2 series, shipped with the gnupg2 package, it comes with no support for S/MIME and some other tools useful for desktop environments, but also with less dependencies.' This page mainly describes how to use the gpg command.
The terms 'OpenPGP', 'PGP', and 'GnuPG / GPG' are often used interchangeably. This is a common mistake, since they are distinctly different.
OpenPGP is technically a proposed standard, although it is widely used. OpenPGP is not a program, and shouldn't be referred to as such. PGP and GnuPG are computer programs that implement the OpenPGP standard.
PGP is an acronym for Pretty Good Privacy, a computer program which provides cryptographic privacy and authentication. For more information, see this Wikipedia article.
GnuPG (aka GPG) is an acronym for GNU Privacy Guard, another computer program which provides cryptographic privacy and authentication. For further information on GnuPG, see this Wikipedia article.
There are several programs which provide a graphical interface to the GnuPG system.
Enigmail, an OpenPGP plugin for Mozilla Thunderbird.
sudo apt-get install enigmail
GNU Privacy Assistant is a graphical user interface for the GnuPG (GNU Privacy Guard).
sudo apt-get install gpa
Seahorse is a GNOME application for managing encryption keys. It also integrates with nautilus, gedit, and in other places for encryption operations. Note: seahorse is installed by default on Ubuntu. It is called 'Passwords and Keys' in Ubuntu.
KGPG is a simple, free, open source KDE frontend for gpg.
sudo apt-get install kgpg
Kleopatra is another KDE frontend for gpg that is integrated with the KDE PIM (although you need to install it separately for now).
sudo apt-get install kleopatra
To generate a key:
Open a terminal and enter:
Enter the keysize. A keysize of 2048 (which is the default) is a good choice.
Hit Y to confirm.
Type O to continue.
You will be asked to tap on the keyboard (or do any of the things you normally do) in order for randomization to take place. This is done so that the encryption algorithm has more human-entered elements, which, combined with the passphrase entered above, will result in the user's private key. Please follow the instructions on the screen till you reach a screen similar to the one below.
You have now generated the key. In the above listing the key-id is D8FC66D2 (yours will be different).
It is probably a good idea to set this key as default in your ~/.bash_profile or ~/.profile. Doing this will allow applications using GPG to automatically use your key.
Set your key as the default key by entering this line in your ~/.bash_profile (along with any other environment variables to be exported):Please note that this will be sourced only during your next login. To use it straight away, you should run the export command in the current shell.
Now restart the gpg-agent and set the relevant environment variable:
If you created an 'RSA (sign only)' key earlier, you will probably want to add encryption capabilities. Assuming you edited ~/.bash_profile as above, open a terminal again and enter:
A revocation certificate must be generated to revoke your public key if your private key has been compromised in any way. It is recommended to create a revocation certificate when you create your key. Keep your revocation certificate on a medium that you can safely secure, like a thumb drive in a locked box.
To create a revocation certificate, enter:
and follow the instructions. Note: you will need the passphrase. The revocation certificate may be printed and/or stored as a file.
Anybody having access to your revocation certificate can revoke your key, rendering it useless. |
Some keyservers allow you to paste an ASCII armored version of your public key in order to upload it. This method is often preferred, because the key comes directly from the user and the user can see that the key has been successfully uploaded.
To create an ASCII armored version of your public key, enter:
This is the command using our example (key-id = D8FC66D2):
This section explains how to upload your public key to a keyserver so that anyone can download it. Once you have uploaded it to one keyserver, it will propagate to the other keyservers. Eventually most of the keyservers will have a copy of your key. You can accelerate the process by uploading your key to several keyservers.
To upload the key, enter:
Using our example (key-id = D8FC66D2), the command is:
To upload the key using a web browser:
Export your key by issuing this command (where GPGKEY is defined above) :
Copy the content of the file mykey.asc.
Open http://keyserver.ubuntu.com/ in a browser window.
Paste the copied content in the box under the label Submitting a new OpenPGP Key.
Click Submit.
Note that keyserver.ubuntu.com is only reachable via IPv4.
OpenPGP implementations can be used to digitally sign, encrypt, and decrypt email messages for heightened security. You can validate your keys with Launchpad, and under some situations, Launchpad will send you signed or encrypted email. You would then use OpenPGP support in your mail reader to decrypt these messages or verify a message's digital signature. Of course, you can also use the OpenPGP support in your mail reader to trade encrypted messages with your colleagues, or sign your own messages so that others can have better assurances that the email that appears to come from you actually does come from you.
The instructions below are not intended to provide you with detailed information on OpenPGP, its various implementations, or its use. These instructions simply provide links that can help you set up your mail reader to be compatible with OpenPGP signed and/or encrypted email.
We need your help to flesh out these instructions!
This section is not all inclusive. Please feel free to add additional mail clients.
Evolution has built-in support for OpenPGP. Look under the Security tab when you edit accounts.
Open Evolution and go to Edit->Preferences.
Choose your email account, click on it, and then click Edit.
Click on the security tab.
In the PGP/GPG Key ID: box, paste your KEY-ID.
Click OK. Click Close.
If you want to use your key in any new email, simply click on the Security menu item in your new mail message, and then click on PGP Sign.
Kmail / Kontact has built-in support For Gutsy, and later releases, everything required is installed by default. See the Kmail GPG page for details.
Claws Mail supports OpenPGP through the plugin claws-mail-pgpinline
claws-mail-pgpinline is available in the 'Universe' repository.
Be nice. Do I really need to explain this?. No racism, sexism, or bigotry allowed. Saying your preferences, like 'I like software X better' is ok. Lounge lizard key generator not working free. Include a description of what the torrent is or include a link to a page which describes the torrent.
The plugin may have to be loaded manually after installing it. Open Claws Mail and select Configuration -> Plugins
If PGP/Core and PGP/inline are in the Plugins dialogue box, the plugins are loaded correctly.
Otherwise, click on the Load Plugin button towards the bottom of the window. In the file selection dialogue, select pgpinline.so and click the Open button.
Configure OpenPGP support in Thunderbird under Enigmail->Preferences and add under GnuPG executable path. The path for GnuPG is /usr/bin/gpg.
Create a ~/.mutt directory and copy this file into it: /usr/share/doc/mutt/examples/gpg.rc
Append this line to the muttrc configuration file.
If you're using Mutt 1.5.13, you'll need to fix the paths to pgpewrap as detailed in this post
This section in need of expansion. Please feel free to add any additional plugins for Firefox or other browsers.
If you use the Chrome or the Chromium browser you can use Goopg to sign and verify emails directly from the Gmail web interface. For details click here).
It's All Text! is a Firefox extension which allows you to edit your mail in your preferred local text editor.
For example, you could use gnupg.vim and a local Vim instance.
You need to validate a key with Launchpad (that is, import it into Launchpad) in order to be able to sign the Ubuntu Code of Conduct (and thus become an Ubuntero) and to build packages using HCT.
To import a key you need the key fingerprint. To list all keys and their fingerprints, enter:
A fingerprint will look something like this:
To import a key:
Paste the fingerprint into the textbox and click 'Import Key'. Launchpad will send you an encrypted email. The text of the email will look similar to this:
Decrypt the text:
https://launchpad.net/token/somealphanumerictoken
Signing data is helpful in verifying if the data from a person is indeed from that person. A typical scenario is described below.
When you've generated a key and imported it, it is time to sign the Ubuntu Code Of Conduct if you want to become an Ubuntu member or Ubuntero:
Download the code of conduct from https://launchpad.net/codeofconduct/2.0/+download.
Enter:
Upload the contents of UbuntuCodeofConduct-2.0.txt.asc on https://launchpad.net/codeofconduct/2.0/+sign
The whole point of all this is to create a web of trust. By signing someone's public key, you state that you have checked that the person that uses a certain keypair, is who they says they are and really is in control of the private key. This way a complete network of people who trust each other can be created. This network is called the Strongly connected set. Information about it can be found at http://pgp.cs.uu.nl/
In summary,
Locate someone that lives near you and can meet with you to verify your ID. Sites like http://www.biglumber.com/ are useful for this purpose
get the last eight digits of your fingerprint: 0995 ECD6 3843 CBB3 C050 28CA E103 6EED 0123 4567
terminal: gpg --fingerprint 01234567 >> key.txt
Since a signature means that you checked and verified that a certain public key belongs to a certain person who is in control of the accompanying private key, you need to follow these guidelines when signing peoples keys:
During this meeting you hand each other your OpenPGP key fingerprint and at least one government issued ID with a photograph. These key fingerprints are usually distributed as key fingerprint slips, created by a script such as gpg-key2ps (package: signing-party)
You now have the printed public key information from the other participants.
Example key IDs for the other participants will be E4758D1D, C27659A2, and 09026E7B. Replace these IDs with the key IDs you received from the other participants.
Retrieve the keys:
Sign the keys:
Export the keys:
Email the key users (use the email address that was part of the key's user ID) and attach the corresponding signature file - or - send their signed key to the key server:
Once you receive your signed key import them to your keyring:
You should see your keys:
Send your keys to the keyserver:
Congrats - you have now entered a web of trust or enlarged an existing one.
Why should you back up your keypair? If you lose your keypair:
You will not be able to decrypt emails sent to you. Decrypting emails sent to you requires your private key, this key is not stored on the keyservers.
If you lose your keypair you should revoke your key. This cannot be done without a revocation certificate.
List your public keys:
Look for the line that starts something like 'pub 1024D/'. The part after the 1024D is the key-id. To export the key:
List your private keys:
Look for the line that starts something like 'sec 1024D/'. The part after the 1024D is the key-id. To export the private key:
To restore your keypair:
Enter the following commands:
Make sure you protect these files!
In the event your keys are lost or compromised, you should revoke your keypair. This tells other users that your key is no longer reliable.
For security purposes, there is no mechanism in place to revoke a key without a revocation certificate. As much as you might want to revoke a key, the revocation certificate prevents malicious revocations. Guard your revocation certificate with the same care you would use for your private key. |
To revoke your key you need to first create a revocation certificate. Indicate the key to be revoked and direct the output to a file. Continuing with the example (key-id = D8FC66D2):
Import your revocation certificate:
Upload the key to your keyserver of choice. Here, the example uses Ubuntu's key server and key-id = D8FC66D2:
If you unintentionally revoke a key, or find that your key has in fact not been lost or compromised, it is possible to un-revoke your key. First and foremost, ensure that you do not distribute the key, or send it to the keyserver.
Export the key:
Split the key into multiple parts. This breaks the key down into multiple parts:
Find which file contains the revocation certificate. In most cases, it is 000002-002.sig, however you should make sure by using the following. If the sigclass is 0x20, you have the right file. Delete it.
Put the key back together:
Remove the old key:
Import the new key:
To change your passphrase:
Enter:
At the gpg prompt enter:
Enter:
You have now changed the passphrase.
Add your key to ~/.bash_profile by adding a line similiar to export GPGKEY=YOUR-KEY-ID
gnupg-agent and pinentry-gtk2 are packages that facilitate not having to enter the password for your key every time you want to use it. Open the file ~/.gnupg/gpg.conf in your favorite editor. Browse through it and change what you like. A few useful things to change are:
Now create the file ~/.gnupg/gpg-agent.conf with the following content:This will make gpg-agent use pinentry-gtk2 and it will remember your password for 24 hours (please consider the security implications for doing this - anyone gaining access to your computer for 24 hours would then be able to sign anything with your key). For Kubuntu, use pinentry-qt4 instead.
GPGKeyOnUSBDrive
UnsignedGpgKey
GPGsigningforSSHHowTo
GNUPG Manual
UbuntuForums Howto, thanks to Kassetra
Beginners Guide to GnuPG -- Ubuntu Forums
http://www.biglumber.com
http://en.wikipedia.org/wiki/Gnupg -- Wikipedia article
Creating & Utilizing PGP Forum Tutorial
HOWTO prep for migration off of SHA-1 in OpenPGP
GnuPG 2.x is a new modularised version of GnuPG supporting OpenPGP and S/MIME. See the man page.
CategorySoftwareCategorySecurity