Enigmail不要求输入pgp密码,但说没有可用的密钥


8

雷鸟中使用enigmail解密电子邮件不再起作用。这是因为我没有机会打入我的密码短语,这种形式的表格经常让我这样做,但现在还没有,我得到了这个信息:

错误-找不到匹配的私钥/秘钥来解密消息;单击“详细信息”按钮以获取更多信息

私钥是可用的,因为

gpg -d Desktop/mail.eml     

使表格出现。填写密码后,我可以在终端中阅读解密的邮件。

今天,当我创建新密钥时,出现了另一个密码短语问题的提示。由于没有设置密码短语,因此我无法创建吊销证书。同样,这是不正确的。

我首先在8月31日星期一注意到了这个问题。

我检查了一下互联网,然后执行以下操作:

  1. 确保gpg-agent实例正在运行:

    gpg-agent -v
    

    退货

    gpg-agent: gpg-agent running and available
    

    .gnupg / gpg-agent.conf的内容:

    默认缓存ttl 0
    最大缓存ttl 0

  2. 转到dconf Editor desktop->gnome->crypto->cache并设置gpg-cache-ttl0

  3. Thunderbird Enigmail->Clear Saved Passphrases 给出一个Enigmail警报说:

    您正在使用gpg-agent进行密码短语处理。因此,无法从Enigmail中清除密码短语。

    Thunderbird Enigmail->Preferences->Basic Remember passphrase for 0 minutes of idle time

  4. gpg-agent忘记我的密码:

    pkill -SIGHUP gpg-agent
    
  5. Seahorse->GnuPG keys 删除所有密钥并重新导入

该列表均未对问题产生任何影响。我想知道如何让Enigmail再次要求输入密码?

提前致谢!
布朗克

编辑

  1. 删除/etc/xdg/autostart/gnome-keyring-gpg.desktop没有任何作用。
  2. 删除seahorse没有任何作用。
  3. 使用decrypt-file

    Couldn't decrypt file: mail.eml.pgp
    Bad passphrase
    

pinentry-gtk2使用Unity在Ubuntu上安装
Natim

我也有这个问题,但是奇怪的是我可以签署自己的电子邮件,但是当我尝试解密用我的pubkey签名的消息时,它也会给您同样的消息。
Geremia

Answers:


7

试试这个:https : //www.enigmail.net/support/gnupg2_issues.php在我的情况下,我需要安装grafical版本的pinentry(pinentry-qt4软件包)。

“解决了GnuPG 2.x和gpg-agent的问题

注意GnuPG 2.x需要一个“代理”来处理密码短语。默认情况下,这是由gpg-agent完成的,但是还有其他工具可以实现其功能的子集。这些说明仅适用于gpg-agent。如果您使用诸如gnome-keyring,seahorse-agent或KDE Wallet Manager之类的代理,则这些说明不适用。最常见的问题

病征

最常见的问题是gpg-agent(GnuPG的一部分)无法启动pinentry(用于查询密码的工具)。Enigmail将显示如下消息:

when reading messages:
Error - no matching private/secret key found to decrypt message; click on 'Details' button for more information

when sending messages:
- Send operation aborted. Error - encryption command failed
- Send operation aborted. Key 0x....... not found or not valid. The (sub-)key might have expired

如何分析

Try sending a signed and unencrypted message to yourself.
Check the output in the Enimgail log: go to menu Enigmail > Debugging Options > View Log.
Search for the following text: parseErrorOutput: status message. You will probably find this message several times. Check what follows below.
If the message says something like "no pinentry", "problem with the agent", "Invalid IPC response" or "problem with gpg-agent", then there is something wrong with your gpg-agent and/or pinentry setup.

如何修复

Execute the following script from a terminal to find out if a graphical version of pinentry is used:

pinentry <<EOT
SETDESC Hello World
CONFIRM
EOT

You should get a graphical window with a confirmation message "Hello World". If a "window" is opened within your terminal window then pinentry is text-based, which does not work with Enigmail. To fix this, ensure that a graphical version of pinentry is installed. On Linux/Unix systems, these would typically be pinentry-qt/pinentry-qt4 or pinentry-gtk/pinentry-gtk2, and on Mac OS X pinentry-mac. Rename the existing pinentry file to "pinentry-text" or similar, and create a symlink from pinentry-qt, pinentry-qt4, pinentry-gtk, pinentry-gtk2 or pinentry-mac to pinentry. Then restart your PC.

If the above does not help, check the contents of $HOME/.gnupg/gpg-agent.conf. Make sure that there is a configuration entry pinentry-program containing the full path to a graphical version of pinentry as above. E.g.:

pinentry-program /usr/local/bin/pinentry-gtk

Then save the file and restart your PC.

If you still can't access your key, then execute the following script from a terminal:

gpg-connect-agent <<EOT
GETINFO version
EOT

The output should be something like the text below, where 2.0.26 represents the agent version number. The version number should match your gpg version number:

D 2.0.26
OK

If you get an error message like "ERR 280 not implemented" then you don't use gpg-agent, but one of the alternatives like gnome-keyring. We recommend you switch to gpg-agent by disabling your current agent. See e.g. askubuntu for how to disable gnome-keyring or how to disable KDE wallet.

If you get a useful result from above, then execute the following script from a terminal:

gpg-connect-agent <<EOT
GET_CONFIRMATION Hello
EOT

Pinentry should now open as a graphical window (just like above), with the difference to the step above that this instance of pinentry was launched from gpg-agent. If this is successful, then GnuPG 2 should work correctly in Enigmail.

If gpg-agent still cannot launch pinentry from Enigmail, then you need to start debugging gpg-agent. Execute the following commands from a terminal:

killall gpg-agent
gpg-agent --debug-level expert --use-standard-socket --daemon /bin/sh

This will start gpg-agent from the command line, open a new shell and print the debug output to that shell. If the command succeeded, you will see somehting like:
gpg-agent[76979]: gpg-agent 2.0.26 started
Leave the terminal window untouched, start Thunderbird and try to use Enigmail. As you'll try to access gpg-agent, you will see the output in your terminal window. If gpg-agent cannot start pinentry successfully, you will see something like this:

gpg-agent[76993]: starting a new PIN Entry
gpg-agent[76993]: chan_19 <- ERR 67109133 can't exec `/usr/bin/pinentry': No such file or directory
gpg-agent[76993]: chan_19 -> BYE
gpg-agent[76993]: can't connect to the PIN entry module: IPC connect call failed
gpg-agent[76993]: command get_passphrase failed: No pinentry

Press Ctrl+D in the terminal to end the debugging session. The bold line should tell you the reason for the error (in the example above, pinentry cannot be found). Try to fix the error and repeat the test."

虽然从理论上讲这可以回答问题,但最好在此处包括答案的基本部分,并提供链接以供参考。
Karl Richter

最后一点是“如果gpg-agent仍然无法从Enigmail启动pinentry,那么...”-但是如果pinentry已正确启动,但是解密仍然无法进行,则该指南在这里
无济于事

1

我遇到了同样的问题,但是发现杀死gpg-agent是一个解决方法。

(从源代码中,我发现您可以通过在〜/ .thunderbird下的某个位置编辑“ defaults / preferences / enigmail.js”文件,并将“ extensions.enigmail.logDirectory”属性设置为“ / tmp”来启用enigmail日志记录。然后,日志文件“ /tmp/enigdbug.txt”显示了enigmail正在运行的完整gpg命令,以“ --use-agent”结尾。我从命令行运行了该gpg命令,并向其提供了加密的电子邮件。抱怨错误消息“ gpg:代理问题:没有PINentry。”对该错误消息进行了搜索,提出了杀死gpg代理的建议。与此同时,NSA欣喜地发现PKI加密的用户体验是好垃圾


我和OP有同样的问题。相反,运行在enigdbug.txt中找到的确切命令会产生完美的结果。:\
Joel Cross

在这里没有帮助。虽然,gpg -d message.eml帽子同样的问题:gpg: public key decryption failed: No passphrase given-不问我的密码
nerdoc

1

我有一个类似的问题。雷鸟一次又一次地要求输入我的钥匙密码,尽管我要求,但Gnome钥匙圈不记得了。问题是,这gpg-agent在我的会话中没有运行。当我在当前会话中手动启动该问题时,该问题消失了:

gpg-agent --debug-level expert --use-standard-socket --daemon /bin/sh

要永久解决该问题,您必须确保该代理正在您的会话中运行:1.检查以下文件/etc/X11/Xsession.d/90gpg-agent。我的看起来像这样:

  : ${GNUPGHOME=$HOME/.gnupg}

  GPGAGENT=/usr/bin/gpg-agent
  PID_FILE="$GNUPGHOME/gpg-agent-info-$(hostname)"

  if grep -qs '^[[:space:]]*use-agent' "$GNUPGHOME/gpg.conf" "$GNUPGHOME/options" &&
     test -x $GPGAGENT &&
     { test -z "$GPG_AGENT_INFO" || ! $GPGAGENT 2>/dev/null; }; then

     if [ -r "$PID_FILE" ]; then
         . "$PID_FILE"
     fi

     # Invoking gpg-agent with no arguments exits successfully if the agent
     # is already running as pointed by $GPG_AGENT_INFO
     if ! $GPGAGENT 2>/dev/null; then
         STARTUP="$GPGAGENT --daemon --sh --write-env-file=$PID_FILE $STARTUP"
     fi
  fi
  1. 检查您是否具有文件~/.gnupg/gpg.conf,至少包含以下行:

    use-agent
    

如果没有,则可以使用以下命令添加它:

echo "use-agent" >>  ~/.gnupg/gpg.conf 

use-agent在OpenGPG 2.1中不再需要-在任何情况下都使用该代理。
nerdoc '17

0

关于pinentry有相同的错误错误。最后,我发现gpg-agent使用了错误的pinentry。通过编辑〜/ .gnupg / gpg-agent.conf并添加以下行来设置正确的密码来解决该问题

pinentry-program /usr/bin/pinentry-gtk-2

我正在使用的系统的默认设置是pinentry-x11(这是公司范围内的安装,允许使用多种窗口管理器),不适用于gnome3。-因此,必须确保gpg-agent使用的实际窗口管理器使用了正确的pinentry。


0

就我而言,只是我没有其他pinentry工具pinentry-curses(带有指针支持的命令行)。因此,在Fedora中安装以下任何密码短语/ PIN输入对话框:

  • pinentry-qt.x86_64 基于Qt4;
  • pinentry-gtk.x86_64 基于GTK +;
  • pinentry-emacs.x86_64 用于emacs;
  • pinentry-gnome3.x86_64 对于GNOME 3。

我使用了GNOME 3 pinentry软件包。


0

在雷鸟中,选择消息,单击汉堡包,展开“ Enigmail”菜单,然后选择“解密/验证”。您将收到一个密码提示,之后将对消息进行解密。


没什么关系...
nerdoc '17

你能澄清一下吗?您没有收到密码提示,还是消息未解密?
Wrong先生

0

我有类似的问题!完成gpg-agent调试后,执行以下操作:

gpg-agent --debug-level expert --use-standard-socket --daemon /bin/sh

我发现enigmail和gpg之间有问题,并且从未要求输入密码。但是在密码被预加载的情况下,所有功能都可以正常工作。

就我而言,问题是什么,过去,我在〜/ .gnupg / gpg.conf中强制执行了Follow选项。

pinentry-mode loopback

这打破了过程。您可以在Enigmail中然后在“调试选项->视图控制台”中检查命令enigmail正在运行以启用专家模式。

评论,一切正常。

By using our site, you acknowledge that you have read and understand our Cookie Policy and Privacy Policy.
Licensed under cc by-sa 3.0 with attribution required.