From 6e4c603fd37d28ea2d02b627fd643cfc15c9a39a Mon Sep 17 00:00:00 2001 From: friendly-rabbit-35 <169707731+friendly-rabbit-35@users.noreply.github.com> Date: Sat, 25 May 2024 21:01:33 +0000 Subject: [PATCH] Update link to community guide Signed-off-by: friendly-rabbit-35 <169707731+friendly-rabbit-35@users.noreply.github.com> --- .../qubes/Using Split GPG and Split SSH on Qubes OS.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/content/posts/qubes/Using Split GPG and Split SSH on Qubes OS.md b/content/posts/qubes/Using Split GPG and Split SSH on Qubes OS.md index ec5e096..0150dab 100644 --- a/content/posts/qubes/Using Split GPG and Split SSH on Qubes OS.md +++ b/content/posts/qubes/Using Split GPG and Split SSH on Qubes OS.md @@ -13,15 +13,15 @@ This post will go over setting up Split GPG, then setting up Split SSH with the Follow the official Qubes OS [documentation](https://www.qubes-os.org/doc/split-gpg/) to set this up. -Note that if you already have a PGP key with a passphrase, you can remove it by installing `pinentry-gtk` to `vault`'s TemplateVM, then do `gpg2 --edit-key ` and `passwd` to set an empty passphrase. The default non-graphical pinentry will just make an infinite loop and will not allow you to set an empty passphrase. +Note that if you already have a PGP key with a passphrase, you can remove it by installing `pinentry-gtk` to `vault`'s TemplateVM, then run `gpg2 --edit-key ` and `passwd` to set an empty passphrase. The default non-graphical pinentry will just make an infinite loop and will not allow you to set an empty passphrase. ## Split SSH -This part is based on the Qubes Community's [guide](https://github.com/Qubes-Community/Contents/blob/master/docs/configuration/split-ssh.md); however, I will deviate from it to use the PGP keys for SSH instead of generating a new key pair. +This part is based on the Qubes Community's [guide](https://forum.qubes-os.org/t/split-ssh/19060); however, I will deviate from it to use the PGP keys for SSH instead of generating a new key pair. ### In `dom0` -- Create `/etc/qubes-rpc/policy/qubes.SshAgent` with `@anyvm @anyvm ask,default_target=vault` as the content. Since the keys ar not passphrase protected, you should **not** set the policy to allow. +- Create `/etc/qubes-rpc/policy/qubes.SshAgent` with `@anyvm @anyvm ask,default_target=vault` as the content. Since the keys are not passphrase protected, you should **not** set the policy to allow. ### In `vault` AppVM - Add `enable-ssh-support` to the end of `~/.gnupg/gpg-agent.conf` @@ -83,4 +83,4 @@ fi - Restart `ssh-client` and confirm if it's working with `ssh-add -L`. ### Limitations -A malicious `ssh-client` AppVM can hold onto the ssh-agent connection for more than one use until it is shut down. While your private key is protected, a malicious actor with access to the AppVM can still abuse the ssh-agent to log into your servers. \ No newline at end of file +A malicious `ssh-client` AppVM can hold onto the ssh-agent connection for more than one use until it is shut down. While your private key is protected, a malicious actor with access to the AppVM can still abuse the ssh-agent to log into your servers.