Git-Mirrors/qusal
1
0
Fork 0
mirror of https://github.com/ben-grande/qusal.git synced 2024-10-01 02:35:49 -04:00
Code Issues Packages Projects Releases Wiki Activity
eed904c7f2
qusal/salt/sys-pgp
History
Ben Grande 383c840f2f
doc: lint markdown files 
Only way to have a unified markdown syntax is to enforce the wanted
syntax by linting the files. Don't rely on the many markdown syntaxes,
be consistent.
2024-07-04 17:27:31 +02:00
..
files/admin/policy fix: strict split-gpg2 service 2023-12-28 11:47:41 +01:00
clone.sls fix: split-gpg2 fedora clashes with debian agent 2024-05-28 15:04:20 +02:00
clone.top refactor: initial commit 2023-11-13 14:33:28 +00:00
configure.sls fix: include shell profile sourcer 2024-06-24 16:32:58 +02:00
configure.top refactor: initial commit 2023-11-13 14:33:28 +00:00
create.sls fix: pgp template is fedora based without salt fix 2024-06-14 07:36:41 +02:00
create.top refactor: initial commit 2023-11-13 14:33:28 +00:00
init.top refactor: initial commit 2023-11-13 14:33:28 +00:00
install-client.sls refactor: initial commit 2023-11-13 14:33:28 +00:00
install-client.top refactor: initial commit 2023-11-13 14:33:28 +00:00
install.sls feat: add manual page reader 2024-05-28 11:00:04 +02:00
install.top refactor: initial commit 2023-11-13 14:33:28 +00:00
prefs.sls fix: pgp template is fedora based without salt fix 2024-06-14 07:36:41 +02:00
prefs.top fix: pgp template is fedora based without salt fix 2024-06-14 07:36:41 +02:00
README.md doc: lint markdown files 2024-07-04 17:27:31 +02:00
version fix: generate RPM Specs for Qubes Builder V2 2024-06-21 17:00:06 +02:00

README.md

sys-pgp

PGP operations through Qrexec in Qubes OS.

Table of Contents

Description

Creates a PGP key holder named "sys-pgp", it will be the default target for split-gpg and split-gpg2 calls for all qubes. Keys are stored in "sys-pgp", and access to them is made from the client through Qrexec.

Installation

  • Top:
sudo qubesctl top.enable sys-pgp
sudo qubesctl --targets=tpl-sys-pgp,sys-pgp state.apply
sudo qubesctl top.disable sys-pgp
sudo qubesctl state.apply sys-pgp.prefs
  • State:
sudo qubesctl state.apply sys-pgp.create
sudo qubesctl --skip-dom0 --targets=tpl-sys-pgp state.apply sys-pgp.install
sudo qubesctl --skip-dom0 --targets=sys-pgp state.apply sys-pgp.configure
sudo qubesctl state.apply sys-pgp.prefs

Install on the client template:

sudo qubesctl --skip-dom0 --targets=tpl-qubes-builder,tpl-dev state.apply sys-pgp.install-client

The client qube requires the split GPG client service to be enabled:

qvm-features QUBE service.split-gpg2-client 1

Access Control

Default policy: any qube can ask via the @default target if you allow it to use split-gpg in sys-pgp.

Allow the work qubes to access sys-pgp, but not other qubes:

qubes.Gpg2 * work   sys-pgp  ask default_target=sys-pgp
qubes.Gpg2 * work   @default ask target=sys-pgp default_target=sys-pgp
qubes.Gpg2 * @anyvm @anyvm   deny

Usage

Consult upstream documentation on how to use split-gpg2.

Save your PGP keys to sys-pgp, using isolated GnuPG home directory per qube at ~/.gnupg/split-gpg/<QUBE>.

On dom0, enabled the service split-gpg2-client for the client qube dev:

qvm-features dev service.split-gpg2-client 1

On the qube sys-pgp, generate or import keys for the client qube dev:

mkdir -p ~/.gnupg/split-gpg/dev
gpg --homedir ~/.gnupg/split-gpg/dev --import /path/to/secret.key
gpg --homedir ~/.gnupg/split-gpg/dev --list-secret-keys

On the qube dev, import the public part of your key:

gpg --import /path/to/public.key