this post was submitted on 11 Nov 2025
30 points (100.0% liked)

Linux

59569 readers
1166 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 6 years ago
MODERATORS
nooter692@lemmy.ml
AgreeableLandscape@lemmy.ml
MarcellusDrum@lemmy.ml
cypherpunks@lemmy.ml
cyclohexane@lemmy.ml
d3Xt3r@lemmy.nz
30
GPG Key Managing (lemmy.ml)
submitted 3 days ago by Zenlix@lemmy.ml to c/linux@lemmy.ml
17 comments fedilink hide all child comments
 

Hey guys, I wanted to ask you how you manage your gpg keys? Having them in plaintext all the time on my hard drive feels unsecure.

I have my ssh keys in a password manager (KeePassXC) that only exposes them to the keyagend, when unlocked. Do you know if something like that exists for pgp too?

you are viewing a single comment's thread
view the rest of the comments
[–] med@sh.itjust.works 3 points 3 days ago* (last edited 3 days ago)

I'd agree that a hardware solution would be best. Something designed specifically to do it. I've been eyeing up the biometric yubikey for a while.

I do this for ssh keys, VPN certs and pgp keys. My solution is pretty budget, I generate the keys on a LUKS encrypted USB and run a script that loads them in to agents, and flushes them on sleep. The script unlocks and mounts the LUKS partition, adds the keys to agents, unmounts and locks the USB. The passwords I just remember for the unlock and load into memory, but they're ripe for stuffing in to keepass-xc - I need to look at the secret service api and incorporate that in to the script to fetch the unlock passwords directly from keepass.

I have symlinks in the default user directories to the USB's mount points, like ~/.ssh/id_ed25519 -> /run/media/<user>/<mount>/id_ed25519. By default, when you run ssh-agent, it tries to add keys in the default places.

The way it works for me is:

  • plug the USB in to the laptop after a restart or wake-up
  • run script
  • enter passwords for luks key, ssh-agent, gpg agent etc.
  • Unplug USB.

I keep break-glass spares in a locked cabinet in my house and office, both with different recovery keys

I do this because it's my historical solution, and I haven't evaluated the hardware options seriously yet.