diff --git a/user/security-in-qubes/split-gpg-2.rst b/user/security-in-qubes/split-gpg-2.rst index a2bcfac7..967e1e2c 100644 --- a/user/security-in-qubes/split-gpg-2.rst +++ b/user/security-in-qubes/split-gpg-2.rst @@ -11,33 +11,33 @@ This way the compromise of your less trusted qube does not allow the attacker to How-to split your GPG keys between two qubes -------------------------------------------- -The following how-to will setup Split GPG-2 with two qubes: +The following how-to will set up Split GPG-2 with two qubes: * one qube holding the private keys, called **server-qube**. This qube is offline and should be trusted. * the other qube using the keys, called **client-qube**. This qube doesn't have to be trusted as much as the server. -Each time you want to do something with a GPG key, the *client-qube* will delegate the operation to the *server-qube*. This qube will ask you to confirm the operation. +Each time you want to do something with a GPG key, the *client qube* will delegate the operation to the *server qube*. This qube will ask you to confirm the operation. Install Split GPG-2 ^^^^^^^^^^^^^^^^^^^ -In the template(s) qube(s) used by *server-qube* and *client-qube*, :ref:`install the split-gpg2 package `. +In the template(s) qube(s) used by the *server qube* and the *client qube*, :ref:`install the split-gpg2 package `. .. note:: If you use a minimal template, make sure to install ``zenity`` Create a policy for Split GPG-2 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -**In dom0**, :doc:`create or edit a RPC policy `. Add a line like the following and make sure to replace :samp:`{client-qube}` and :samp:`{server-qube}` by the appropriate values. +**In dom0**, :doc:`create or edit an RPC policy `. Add a line like the following and make sure to replace :samp:`{client-qube}` and :samp:`{server-qube}` by the appropriate values. .. code:: text qubes.Gpg2 + client-qube @default allow target=server-qube -Generate or import the secret keys in the server qube -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +Generate or import the secret keys in the *server qube* +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -**In server-qube**, you have two options: +**In the server qube**, you have two options: * either generate your secret keys, like this: @@ -45,14 +45,16 @@ Generate or import the secret keys in the server qube [user@server-qube] $ gpg --gen-key -* or, if you want to use some old keys, previously generated in an other qube, import them and the ownertrust. Make sure to replace :file:`/home/user/QubesIncoming/{}/{[...]}` by the path of the expected file: +* or, if you want to use some old keys, previously generated in another qube, import them and the ownertrust. Make sure to replace :file:`/home/user/QubesIncoming/{}/{[...]}` by the path of the expected file: .. code:: console [user@server-qube] $ gpg --import /home/user/QubesIncoming//secret-keys-export [user@server-qube] $ gpg --import-ownertrust /home/user/QubesIncoming//ownertrust-export -In both situations, you have to export the public part of your keys and the "ownertrust" values in the client qube: +.. note:: Ensure your key doesn't have a passphrase set. + +In both situations, you have to export the public part of your keys and the "ownertrust" values in the *client qube*: .. code:: console @@ -65,15 +67,15 @@ In both situations, you have to export the public part of your keys and the "own Set up the *client qube* ^^^^^^^^^^^^^^^^^^^^^^^^ -Enable ``split-gpg2-client`` service in *client qube* -""""""""""""""""""""""""""""""""""""""""""""""""""""" +Enable the ``split-gpg2-client`` service in the *client qube* +""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""" -The first step is to :doc:`enable the qube service ` called ``split-gpg2-client``. +The first step is to :doc:`enable the qube service ` called ``split-gpg2-client``. Restarting the *client qube* is needed. Import the public keys and ownertrust """"""""""""""""""""""""""""""""""""" -If you have previously exported the public keys and the "ownertrust" values from *server-qube*. Now, you have to import them in the client qube. Replace the following paths by the correct values. +If you have previously exported the public keys and the "ownertrust" values from the *server qube*. Now, you have to import them in the *client qube*. Replace the following paths by the correct values. .. code:: console @@ -131,7 +133,7 @@ By setting up some values in the configuration file, you can change some paramet :default: ``no`` :allowed values: ``no``, ``yes`` or any integer - By default, all requests made to the *server-qube* need to be confirmed. You can tell Split GPG-2 to accept requests: never (``no``), always (``yes``) or during a period of time after a successful request. To accept all requests following a successful one during one minute, use a value of ``60`` seconds. + By default, all requests made to the *server qube* need to be confirmed. You can tell Split GPG-2 to accept requests: never (``no``), always (``yes``) or during a period of time after a successful request. To accept all requests following a successful one during one minute, use a value of ``60`` seconds. This option has two alternatives: @@ -181,7 +183,7 @@ This option has two alternatives: :type: full path :default: empty - If you store different keys for different client qubes in the same server qube, you can isolate each GnuPG home, by setting :confval:`isolated_gnupghome`. The value points at a directory where each client will get its own subdirectory. For example, when this option is set to :file:`/home/user/gpg-home`, then the qube *personal* will use :file:`/home/user/gpg-home/{personal}` as GnuPG home. + If you store different keys for different *client qubes* in the same *server qube*, you can isolate each GnuPG home, by setting :confval:`isolated_gnupghome`. The value points at a directory where each client will get its own subdirectory. For example, when this option is set to :file:`/home/user/gpg-home`, then the qube *personal* will use :file:`/home/user/gpg-home/{personal}` as GnuPG home. If you do this, don't forget to use the option ``--gnupg-home`` or the environment variable ``GNUPGHOME`` when using :program:`gpg` commands.