Gnu PGP my cheat sheet

How to import PGP public key?
gpg --import 99242560.key
gpg: key DB698D7199242560: public key "David M. Shaw <dshaw@jabberwocky.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: next trustdb check due at 2018-01-09

How to verify the file signature?
gpg --verify paperkey-1.4-win32.zip.sig
gpg: assuming signed data in 'paperkey-1.4-win32.zip'
gpg: Signature made 09/06/16 02:01:14 GMT Daylight Time
gpg:                using RSA key FEA78A7AA1BC4FA4
gpg: Good signature from "David M. Shaw <dshaw@jabberwocky.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 7D92 FD31 3AB6 F373 4CC5  9CA1 DB69 8D71 9924 2560
     Subkey fingerprint: A154 3829 812C 9EA9 87F1  4526 FEA7 8A7A A1BC 4FA4

How to export private PGP key to other machine?
gpg --export-secret-keys | gpg --symmetric --cipher-algo AES256 --armor > key.asc

How to import private PGP key from other machine (note the "--output -" parameter, it is necessary to pipe output to import command)?
gpg --output - key.asc | gpg --import

After importing key, we need to edit it, to assign a trust to that key
gpg --edit-key key.email@gmail.com
Secret key is available.

 gpg> trust
sec  rsa4096/07EAAD40AAD862C2
     created: 2017-05-24  expires: 2018-01-09  usage: SC
     trust: unknown       validity: unknown
ssb  rsa4096/49B31AC5FDCC14EF
     created: 2017-05-24  expires: 2018-01-09  usage: E
[ unknown] (1). Bart Prokop (2017) <prokop.bart@gmail.com>

Please decide how far you trust this user to correctly verify other users' keys
(by looking at passports, checking fingerprints from different sources, etc.)

  1 = I don't know or won't say
  2 = I do NOT trust
  3 = I trust marginally
  4 = I trust fully
  5 = I trust ultimately
  m = back to the main menu

Your decision? 5
Do you really want to set this key to ultimate trust? (y/N) y

gpg> quit
.
.
.

Comments

Post a Comment

Popular posts from this blog

Hardening OpenWRT - adding non-root user account

I have at home an OpenWRT on TP-Link 1043ND. As I'm most of the time out of my home, I use this for two functions:  - as reliable WiFi Access Point  - as last resort remote access device  - as a box used to wake up other Ethernet enabled devices @ home. As this box is exposed to Internet via IPv6 address, I decided to harden it a little. 1. Adding extra non privileged user account: root@OpenWrt:~# opkg update root@OpenWrt:~# opkg install shadow-useradd root@OpenWrt:~# mkdir /home root@OpenWrt:~# useradd -D GROUP=100 HOME=/home INACTIVE=-1 EXPIRE= SHELL= SKEL=/etc/skel CREATE_MAIL_SPOOL=no root@OpenWrt:~# useradd -m -s /bin/ash bart root@OpenWrt:~# cat /etc/passwd root:x:0:0:root:/root:/bin/ash daemon:*:1:1:daemon:/var:/bin/false ftp:*:55:55:ftp:/home/ftp:/bin/false network:*:101:101:network:/var:/bin/false nobody:*:65534:65534:nobody:/var:/bin/false bart:x:1000:1000::/home/bart:/bin/ash root@OpenWrt:~# passwd bart Changing password for bart New passw
Read more

Dropbear SSH keys and autossh on OpenWRT

Image
I have a box on Amazon EC2. And I want to have my OpenWRT that is behind IPv4 CGN and have public IPv6 to be reachable from IPv4 Internet. The best idea is to use ssh reverse tunnel connected with autossh to keep connection going. The very first think is to test if I can connect to my Amazon instance from my OpenWRT: root@OpenWrt:~# ssh 54.111.111.111 Host '54.111.111.111' is not in the trusted hosts file. (ssh-rsa fingerprint md5 0f:51:11:11:11:11:11:11:11:11:11:11:11:11:11:11) Do you want to continue connecting? (y/n) y root@54.111.111.111's password: At this point the public key of remote host will be added to .ssh/known_hosts. It is important as we can't have autossh to interact with console in future. root@OpenWrt:~# cat .ssh/known_hosts 2001:1111:1111:1111::1111:1111 ssh-rsa AAAAB3N....... 54.111.111.111 ssh-rsa AAAAB3N.......... Now we need to generate public/private key pair we will be using to connect to our Amazon instance. Invoke fol
Read more

SSH Tunel with OpenWRT

You need to install OpenSSH client: root@OpenWrt:~# opkg update root@OpenWrt:~# opkg install openssh-client Now OpenSSH client replaced DropBear client: root@OpenWrt:~# ls -l /usr/bin/ssh -rwxr-xr-x    1 root     root        590667 May 24 14:54 /usr/bin/ssh root@OpenWrt:~# ls -l /rom/usr/bin/ssh lrwxrwxrwx    1 root     root            16 Aug 19  2016 /rom/usr/bin/ssh -> ../sbin/dropbear root@OpenWrt:~# ls -l /overlay/upper/usr/bin/ssh -rwxr-xr-x    1 root     root        590667 May 24 14:54 /overlay/upper/usr/bin/ssh Can you spot a difference: root@OpenWrt:~# ssh usage: ssh [-1246AaCfGgKkMNnqsTtVvXxYy] [-b bind_address] [-c cipher_spec]            [-D [bind_address:]port] [-E log_file] [-e escape_char]            [-F configfile] [-I pkcs11] [-i identity_file]            [-J [user@]host[:port]] [-L address] [-l login_name] [-m mac_spec]            [-O ctl_cmd] [-o option] [-p port] [-Q query_option] [-R address]            [-S ctl_path] [-W ho
Read more