2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018

04/22/2014: How to Generate a PGP Key on Headless Unix (also called How to Increase Your Entropy)

It took way too long for me to find this series of steps. I ran until a problem generating a gpg key because my system did not have enough entropy. You can check your entropy using

cat /proc/sys/kernel/random/entropy_avail

Run through this procedure at least once manually before trusting it in a batch scenario.

First, let's generate a configuration file for the gpg-key. Note that no pass-phrase is specified. If that's a problem, you can add a 'Passphrase:' line. Also note that the umask changes for better protection of the configuration file.

umask 0277
cat << EOF > /tmp/$USER-gpg-genkey.conf
%echo Generating a package signing key
Key-Type: DSA
Key-Length: 1024
Subkey-Type: ELG-E
Subkey-Length: 2048
Name-Real:  `hostname --fqdn`
Name-Email: $USER@`hostname --fqdn`
Expire-Date: 0
%commit
%echo Done
EOF
umask 0002

Now we start a background task to generation hashes. This task increases your entropy. And we store its PID for later use.

(find / -xdev -type f -exec sha256sum {} >/dev/null \; 2>&1) &
export ENTROPY=$!

Next generate the key. Make sure you look at the log files at least once to see if any errors were generated. When done, kill the entropy-generating process and delete the configuration file.

gpg --batch --gen-key /tmp/$USER-gpg-genkey.conf > gpg-keygen.log 2> gpg-keygen_error.log
ps -ef | grep find | awk '{ print $2 }' | grep ${ENTROPY} && kill ${ENTROPY}
rm /tmp/$USER-gpg-genkey.conf

I wish I still had the URL were I found this tidbit. Sorry.



subscribe via RSS