s83/YubiKey-Guide
1
0
Fork 0
mirror of https://github.com/drduh/YubiKey-Guide.git synced 2025-04-18 08:14:22 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #476 from drduh/wip-16mar25

Browse source 
update config urls
This commit is contained in:
drduh 2025-03-17 15:44:36 +00:00 • committed by GitHub
commit 466649f728
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 11 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
README.md
View file

@ -272,17 +272,17 @@ sudo dnf install \
Create a temporary directory which will be cleared on [reboot](https://en.wikipedia.org/wiki/Tmpfs) and set it as the GnuPG directory: Create a temporary directory which will be cleared on [reboot](https://en.wikipedia.org/wiki/Tmpfs) and set it as the GnuPG directory:
```console ```console
export GNUPGHOME=$(mktemp -d -t gnupg-$(date +%Y-%m-%d)-XXXXXXXXXX) export GNUPGHOME=$(mktemp -d -t $(date +%Y.%m.%d)-XXXX)
``` ```
## Configuration ## Configuration
Import or create a [hardened configuration](https://github.com/drduh/config/blob/master/gpg.conf): Import or create a [hardened configuration](https://github.com/drduh/config/blob/main/gpg.conf):
```console ```console
cd $GNUPGHOME cd $GNUPGHOME
wget https://raw.githubusercontent.com/drduh/config/master/gpg.conf wget https://raw.githubusercontent.com/drduh/config/main/gpg.conf
``` ```
The options will look similar to: The options will look similar to:
@ -934,12 +934,12 @@ Initialize GnuPG:
gpg -k gpg -k
``` ```
Import or create a [hardened configuration](https://github.com/drduh/config/blob/master/gpg.conf): Import or create a [hardened configuration](https://github.com/drduh/config/blob/main/gpg.conf):
```console ```console
cd ~/.gnupg cd ~/.gnupg
wget https://raw.githubusercontent.com/drduh/config/master/gpg.conf wget https://raw.githubusercontent.com/drduh/config/main/gpg.conf
``` ```
Set the following option. This avoids the problem where GnuPG will repeatedly prompt for the insertion of an already-inserted YubiKey: Set the following option. This avoids the problem where GnuPG will repeatedly prompt for the insertion of an already-inserted YubiKey:
@ -1094,7 +1094,7 @@ echo "test message string" | \
--output encrypted.txt --output encrypted.txt
``` ```
Use a [shell function](https://github.com/drduh/config/blob/master/zshrc) to make encrypting files easier: Use a [shell function](https://github.com/drduh/config/blob/main/zshrc) to make encrypting files easier:
```console ```console
secret () { secret () {
@ -1193,12 +1193,12 @@ YubiKey will blink when it is waiting for a touch. On Linux, [maximbaz/yubikey-t
## SSH ## SSH
Import or create a [hardened configuration](https://github.com/drduh/config/blob/master/gpg-agent.conf): Import or create a [hardened configuration](https://github.com/drduh/config/blob/main/gpg-agent.conf):
```console ```console
cd ~/.gnupg cd ~/.gnupg
wget https://raw.githubusercontent.com/drduh/config/master/gpg-agent.conf wget https://raw.githubusercontent.com/drduh/config/main/gpg-agent.conf
``` ```
**Important** The `cache-ttl` options do **not** apply when using YubiKey as a smart card, because the PIN is [cached by the smart card itself](https://dev.gnupg.org/T3362). To clear the PIN from cache (equivalent to `default-cache-ttl` and `max-cache-ttl`), remove YubiKey, or set `forcesig` when editing the card to be prompted for the PIN each time. **Important** The `cache-ttl` options do **not** apply when using YubiKey as a smart card, because the PIN is [cached by the smart card itself](https://dev.gnupg.org/T3362). To clear the PIN from cache (equivalent to `default-cache-ttl` and `max-cache-ttl`), remove YubiKey, or set `forcesig` when editing the card to be prompted for the PIN each time.
@ -1849,14 +1849,12 @@ sudo mkdir /mnt/public
sudo mount /dev/sdc2 /mnt/public sudo mount /dev/sdc2 /mnt/public
``` ```
Copy the original private key materials to a temporary working directory: Copy the original private key materials (after updating the encrypted storage directory name) to a temporary working directory:
```console ```console
export GNUPGHOME=$(mktemp -d -t gnupg-$(date +%Y-%m-%d)-XXXXXXXXXX) export GNUPGHOME=$(mktemp -d -t $(date +%Y.%m.%d)-XXXX)
cd $GNUPGHOME cp -avi /mnt/encrypted-storage/2025.12.31-AbCd/* $GNUPGHOME/
cp -avi /mnt/encrypted-storage/gnupg-*/* $GNUPGHOME
``` ```
Confirm the identity is available, set the key id and fingerprint: Confirm the identity is available, set the key id and fingerprint: