KMail/PGP MIME: Difference between revisions

From KDE UserBase Wiki
m (Fixed syntax of gpgagent.sh and stop_gpgagent.sh scripts)
(Marked this version for translation)
 
(18 intermediate revisions by 4 users not shown)
Line 1: Line 1:
=Setting up Signed Messages using GPG in Kmail=
<languages />
Fajar Priyanto 2004
<translate>
==Creating, backing-up, and publishing your key==
1. You're going to need the gpg program. It's already being installed by default.


2. Create your own key (type this as yourself, not root): gpg --gen-key Follow the instruction, it's very clear and easy.
==Setting up Signed Messages using GPG in Kmail== <!--T:1-->
by Fajar Priyanto, 2004 (last update 2019)


===Creating, backing-up, and publishing your key=== <!--T:2-->
<!--T:3-->
1. You're going to need the '''gpg''' program. It's already being installed by default.
<!--T:4-->
2. Create your own key (type this as yourself, not root):
{{Input|1=gpg --gen-key}} Follow the instructions, it's very clear and easy.
<!--T:5-->
3. Check that it's already created:  
3. Check that it's already created:  
gpg --list-key  
{{Input|1=gpg --list-key}}
You will see something like this with your own credentials:  
You will see something like this with your own credentials:  
{|style="width:75%; border:2px dotted #BCBCBC; background:#EEEEEE;"
 
| :pub 1024D/85EEC6A5 2004-03-15 Fajar Priyanto (Knowledge is power! http://linux.arinet.org) sub 1024g/BBBB57F3 2004-03-15
<!--T:6-->
|}
{{Output|1=pub   rsa4096 2004-03-15 [SC]
4. Look at the above details. For example 85EEC6A5 is your key ID. Now, in order to export your public key:
      D9C687FBA8DB7AB93E06E737931BC29844664E2D
{|style="width:75%; border:2px dotted #BCBCBC; background:#EEEEEE;"
uid          [ultimate] Fajar Priyanto <mail@example.com>
| :gpg -ao fajar-pub.key --export 85EEC6A5
sub   rsa4096 2004-03-15 [E]}}
|}
 
<!--T:7-->
4. Now, in order to export your public key:
{{Input|1=gpg --armor --output fajar-pub.key --export [email protected]}}
 
<!--T:8-->
A file called '''fajar-pub.key''' will be created in the current directory. This is a copy of your public key. This is also the file that people must import to verify your signed emails. You can publish it in keyservers around the world, or you can send it directly to the people requesting it, or you can place it in your website for others to download.  
A file called '''fajar-pub.key''' will be created in the current directory. This is a copy of your public key. This is also the file that people must import to verify your signed emails. You can publish it in keyservers around the world, or you can send it directly to the people requesting it, or you can place it in your website for others to download.  


If you see inside, it will be like this:  
<!--T:9-->
{|style="width:75%; border:2px dotted #BCBCBC; background:#EEEEEE;"
If you look inside the file, it will be like this:  
|
{{Output|1=-- --BEGIN PGP PUBLIC KEY BLOCK-- --<!--}}-->
-- --BEGIN PGP PUBLIC KEY BLOCK-- --
 
Version: GnuPG v1.2.3 (GNU/Linux)


<!--T:11-->
mQGiBEBVTw8RBACaYvnDkgqNWyktg3urdE9mrpv63x3Iux2zVkuZk8pIRp5HeR/V
mQGiBEBVTw8RBACaYvnDkgqNWyktg3urdE9mrpv63x3Iux2zVkuZk8pIRp5HeR/V


<!--T:12-->
[snip snip...]
[snip snip...]


<!--T:13-->
B394acuU4FdGN/EynYUAn1aRvNmgs0/IU2MDzYQpbHIaqpkE
B394acuU4FdGN/EynYUAn1aRvNmgs0/IU2MDzYQpbHIaqpkE


=B0cy
<!--T:14-->
=RIZC


<!--T:15-->
-- --END PGP PUBLIC KEY BLOCK-- --
-- --END PGP PUBLIC KEY BLOCK-- --
|}
<!--{{-->}}


<!--T:16-->
Also, you might want to back up your secret key to a secure medium (not just one floppy: this will get damaged), you can use the following command:  
Also, you might want to back up your secret key to a secure medium (not just one floppy: this will get damaged), you can use the following command:  
{|style="width:75%; border:2px dotted #BCBCBC; background:#EEEEEE;"
 
|
<!--T:17-->
$ gpg -ao secret.asc --export-secret-keys 85EEC6A5
{{Input|1= $ gpg --armor --output secret.asc --export-secret-keys [email protected]}}
|}
 
<!--T:18-->
This will create a textfile containing your secret or private key, with the filename '''secret.asc'''. Do not hand it to someone you do not trust 100%. Hide it in a safe place (or better, more than one).  
This will create a textfile containing your secret or private key, with the filename '''secret.asc'''. Do not hand it to someone you do not trust 100%. Hide it in a safe place (or better, more than one).  


<!--T:19-->
Finally, it is advisable to generate a revocation certificate and store it in a safe place away from your secret key. In case your secret key gets into the wrong hands, you can revoke it so it can not easily be abused by others. The command to do this is  
Finally, it is advisable to generate a revocation certificate and store it in a safe place away from your secret key. In case your secret key gets into the wrong hands, you can revoke it so it can not easily be abused by others. The command to do this is  
{|style="width:75%; border:2px dotted #BCBCBC; background:#EEEEEE;"
{{Input|1=$ gpg --armor --output revoker.asc --gen-revoke [email protected]}}
|
 
$ gpg -a -o revoker.asc --gen-revoke 85EEC6A5
<!--T:20-->
|}
This will create a textfile with the name '''revoker.asc''' containing the revocation certificate.  
This will create a textfile with the name '''revoker.asc''' containing the revocation certificate.  


===Setting up Kmail to sign emails using your gpg key === <!--T:21-->
==Setting up Kmail to sign emails using your gpg key ==
:1. Fire up Kmail, and go to Setting > Configure Kmail > Identities >  


:2. Choose the identity that you are using  
<!--T:22-->
# Fire up '''Kmail''', and go to <menuchoice>Settings -> Configure KMail -> Accounts -> Identities </menuchoice>
# Choose the identity that you are using  
# Then click <menuchoice>Modify -> Cryptography -> OpenPGP signing key</menuchoice>
# It will automatically show your gpg key, that is 'Your Name <[email protected]>''
# If it will not, click <menuchoice>No key</menuchoice>, and choose your  key
# Now, set up '''Kmail''' to automatically sign all emails that you write using your key
# Still in the Cryptography tab, tick <menuchoice>Automatically sign messages</menuchoice>
# In the '''Kmail''' Configure menu, go to <menuchoice>Security -> Composing</menuchoice>
# Tick mark these:
##Store sent messages encrypted,
##Always show the encryption key for approval,
# Exit the configuration menu by clicking <menuchoice>OK</menuchoice>.


:3. Then click Modify > Advance > OpenPGP Key


:4. It will automatically go to the path of your gpgkey, that is ''~/.gnupg''
===Testing Kmail by creating a new message === <!--T:23-->


:5. Click on the key ID > OK


:6. Now, set up Kmail to automatically sign all emails that you write using your key
<!--T:47-->
#  You will notice that there is a Sign Message banner. It's already active.


:7. Still in the Kmail Configure menu, go to Security > General
<!--T:48-->
[[File:Kmail_gpg_sign_banner.png|400px|center]]


:8. Tick mark these: Show signed/encrypted message after composing, Always show the encryption key for approval, Automatically sign messages using OpenPGP?
<!--T:24-->
# Write your message and when you are done, send it.
# '''Kmail''' will ask for you to type the secret passphrase that you made during the ''gpg --gen-key'' step. Type it in, and then '''Kmail''' will show you a confirmation window of the signed message. Click <menuchoice>OK</menuchoice> to send it.  
# If you test it by sending to yourself, you will notice that '''Kmail''' displays the message with a GREEN header, with words like this: Message was signed by Fajar Priyanto (Knowledge is power! http://linux.arinet.org) (Key ID: 0x85EEC6A5). The signature is valid and the key is ultimately trusted.
# People that have your public key will have that display also, but those who don't have the key, will have the message displayed in yellow with words like this: Message was signed with unknown key 0xBFE7357F. The validity of the signature cannot be verified.


:9. Exit the configuration menu by clicking OK.
<!--T:25-->
'''CONGRATULATIONS! '''


<!--T:26-->
You now can communicate in a more secure way if you want to. I know this how-to is very short and might not be very clear. Well, please give me suggestions and I will improve it when the time comes. Also I intend to write the second part of this topic which covers how to ENCRYPT messages, import other public keys, and install Crypto Plug-ins. Special thanks to Tim Sawchuck and Philip Cronje and all my friends in the Mandrake List.


   
   
==Testing Kmail by creating a new message ==
===Issues=== <!--T:27-->
:1.  You will notice that there is a Sign Message icon right after the paperclip (attachment) icon. It's already active.
:2. Write your message and when you are done, send it.


:3. Kmail will ask for you to type the secret paraphrase that you made during the ''gpg --gen-key'' step. Type it in, and then Kmail will show you a confirmation windows of the signed message. Click OK to send it.  
<!--T:28-->
* Messages signed by a key already known display correctly in '''KMail''', but new keys were not being imported, and you can't sign messages. The culprit is a missing package. Installing pinentry-qt (you may need pinentry-qt4) appears to solve both problems.  


:4. If you test it by sending to yourself, you will notice that Kmail display the message with a GREEN header, with words like this: Message was signed by Fajar Priyanto (Knowledge is power! http://linux.arinet.org) (Key ID: 0x85EEC6A5). The signature is valid and the key is ultimately trusted.  
<!--T:29-->
* '''KMail''' no longer does in-line signatures. GnuPG has to be used instead. [[Special:myLanguage/KGpg|KGPG]] is a useful application that helps in the management of signatures, both your own and those collected.


:5. People that have your public key will have that display also, but they who don't, will have the message displayed in yellow with words like this: Message was signed with unknown key 0xBFE7357F. The validity of the signature cannot be verified.  
<!--T:31-->
{{Note|1=To be sure the "passphrase agent" (gpg-agent) is enabled, check your ''~/.gnupg/gpg.conf'' and eventually uncomment the line containing "use-agent". <br />
In '''KMail's''' <menuchoice>Settings -> Configure KMail -> Security tab -> Miscellaneous</menuchoice>, select <menuchoice>GnuPG Settings</menuchoice>, then <menuchoice>Configure</menuchoice>. On the GPG Agent page, give a path to which logs can be written (<menuchoice>Write server mode logs to FILE</menuchoice>), in case of problems. You can check the log in''' KMail's''' <menuchoice>Tools -> Filter Log Viewer</menuchoice>. It's probably a good idea, too, to increase the cache time - I use 3600. }}


'''CONGRATULATIONS! '''
<!--T:32-->
You now can communicate in a more secure way if you want to. I know this howto is very short and might not be very clear. Well, please give me suggestions and I will improve it when the time comes. Also I intend to write the second part of this topic which covers how to ENCRYPT messages, import other's public key, and install Crypto Plug-ins. Special thanks to Tim Sawchuck and Philip Cronje and all my friends in the Mandrake List.
{{Warning|1=The following startup and shutdown scripts may be already in use from your distro, but not written in this path. Do not install these scripts unless you have problems with startup and shutdown}}


<!--T:33-->
==Issues==
* If you do not have it already, in ''~/.config/plasma-workspace'' create a directory called ''env''. In there, create a file called ''gpgagent.sh'' containing


:* Messages signed by a key already known display correctly in KMail, but new keys were not being imported, and you can't sign messages. The culprit is a missing package. Installing pinentry-qt appears to solve both problems.
<!--T:34-->
{{Input|1=
<nowiki>#</nowiki>!/bin/bash
killall gpg-agent
eval `gpg-agent --daemon`
}}


:* KMail no longer does in-line signatures. OpenGPG has to be used instead. KGpg is a useful applet that helps in the management of signatures, both your own and those collected.  
<!--T:35-->
Save it and make it executable.  


:* If OpenGPG is functioning correctly you will have to give the pass-phrase every time you send a document that is to be signed. This soon becomes a pain, and the way out of that is to configure gpg-agent, which comes with kdebase-common. Unfortunately, the install does not pick up the need for ''pinentry.qt'' or ''pinentry.gtk'' (KDE or GNOME), so that has to be installed separately. The config file for ''gpg-agent'' is written to by KMail's settings.
<!--T:36-->
In the same way you would clean up gpg-agent on shutdown, so if you do not have it already, create another directory called ''shutdown'' into ''~/.config/plasma-workspace'' and create in it another script file called ''stop_gpgagent.sh'' containing


::To be sure the "passphrase agent" (gpg-agent) is enabled check your ''~/.gnupg/gpg.conf'' and eventually uncomment the line containing "use-agent".
<!--T:37-->
In KMail's Settings > Configure KMail > Security tab > Crypto Backends, select OpenGPG, then Configure. On the GPG Agent page, give a path to which logs can be written, in case of problems. You can check the log in KMail's Tools > GnuPG Log Viewer. It's probably a good idea, too, to increase the cache time - I use 3600.
{{Input|1=
<nowiki>#</nowiki>!/bin/bash
killall gpg-agent
}}


:* If you do not have it already, in ''~/.kde'' create a directory called ''env''. In there, create a file called ''gpgagent.sh'' containing
<!--T:38-->
Save it and make it executable.  


{|style="width:75%; border:2px dotted #BCBCBC; background:#EEEEEE;"
===Troubleshooting Tips === <!--T:39-->
|<nowiki>#</nowiki>!/bin/bash
|-
|killall gpg-agent
|-
|eval `gpg-agent --daemon`
|}
 
Save it and make it executable.


In the same way you would clean up gpg-agent on shutdown, so if you do not have it already, create another directory called ''shutdown'' into ''~/.kde'' and create in it another script file called ''stop_gpgagent.sh'' containing
<!--T:40-->
{{Input|1=ps -edalf {{!}} grep gpg-agent }} will list any running instances of gpg-agent.  


{|style="width:75%; border:2px dotted #BCBCBC; background:#EEEEEE;"
<!--T:41-->
|<nowiki>#</nowiki>!/bin/bash
{{Input|1=killall gpg-agent}} stops all instances
|-
|killall gpg-agent
|}


Save it and make it executable.
<!--T:42-->
{{Input|1=eval "$(gpg-agent --daemon)"}} will restart the agent


<!--T:43-->
==Troubleshooting Tips ==
{{Input|1=gpg-agent status}} should tell you if the agent is running.
{|style="width:75%; border:2px dotted #BCBCBC; background:#EEEEEE;"
|
ps -edalf | grep gpg-agent
|}
will list any running instances of gpg-agent.  


{|style="width:75%; border:2px dotted #BCBCBC; background:#EEEEEE;"
== More Information == <!--T:49-->
|
killall gpg-agent
|}
stops all instances


{|style="width:75%; border:2px dotted #BCBCBC; background:#EEEEEE;"
<!--T:46-->
|
* [[Special:myLanguage/KMail/gpg|The Overview page]] has more hints and tips.
eval "$(gpg-agent --daemon)"
* [https://gnupg.org/ GnuPG website]
|}
* [https://gnupg.org/documentation/manuals/gnupg/ GnuPG manual]
will restart the agent
* [https://gnupg.org/documentation/guides.html GnuPG guide]


{|style="width:75%; border:2px dotted #BCBCBC; background:#EEEEEE;"
<!--T:44-->
|
[[Category:Office]]
gpg-agent status
[[Category:Internet]]
|}
[[Category:Privacy]]
should tell you if the agent is running.
</translate>

Latest revision as of 12:29, 1 March 2019

Setting up Signed Messages using GPG in Kmail

by Fajar Priyanto, 2004 (last update 2019)

Creating, backing-up, and publishing your key

1. You're going to need the gpg program. It's already being installed by default.

2. Create your own key (type this as yourself, not root):

gpg --gen-key

Follow the instructions, it's very clear and easy.


3. Check that it's already created:

gpg --list-key

You will see something like this with your own credentials:

pub   rsa4096 2004-03-15 [SC]
      D9C687FBA8DB7AB93E06E737931BC29844664E2D
uid           [ultimate] Fajar Priyanto <[email protected]>
sub   rsa4096 2004-03-15 [E]

4. Now, in order to export your public key:

gpg --armor --output fajar-pub.key --export [email protected]

A file called fajar-pub.key will be created in the current directory. This is a copy of your public key. This is also the file that people must import to verify your signed emails. You can publish it in keyservers around the world, or you can send it directly to the people requesting it, or you can place it in your website for others to download.

If you look inside the file, it will be like this:

-- --BEGIN PGP PUBLIC KEY BLOCK-- --

mQGiBEBVTw8RBACaYvnDkgqNWyktg3urdE9mrpv63x3Iux2zVkuZk8pIRp5HeR/V

[snip snip...]

B394acuU4FdGN/EynYUAn1aRvNmgs0/IU2MDzYQpbHIaqpkE

=RIZC

-- --END PGP PUBLIC KEY BLOCK-- --

Also, you might want to back up your secret key to a secure medium (not just one floppy: this will get damaged), you can use the following command:

$ gpg --armor --output secret.asc --export-secret-keys [email protected]

This will create a textfile containing your secret or private key, with the filename secret.asc. Do not hand it to someone you do not trust 100%. Hide it in a safe place (or better, more than one).

Finally, it is advisable to generate a revocation certificate and store it in a safe place away from your secret key. In case your secret key gets into the wrong hands, you can revoke it so it can not easily be abused by others. The command to do this is

$ gpg --armor --output revoker.asc --gen-revoke [email protected]

This will create a textfile with the name revoker.asc containing the revocation certificate.

Setting up Kmail to sign emails using your gpg key

  1. Fire up Kmail, and go to Settings -> Configure KMail -> Accounts -> Identities
  2. Choose the identity that you are using
  3. Then click Modify -> Cryptography -> OpenPGP signing key
  4. It will automatically show your gpg key, that is 'Your Name <[email protected]>
  5. If it will not, click No key, and choose your key
  6. Now, set up Kmail to automatically sign all emails that you write using your key
  7. Still in the Cryptography tab, tick Automatically sign messages
  8. In the Kmail Configure menu, go to Security -> Composing
  9. Tick mark these:
    1. Store sent messages encrypted,
    2. Always show the encryption key for approval,
  10. Exit the configuration menu by clicking OK.


Testing Kmail by creating a new message

  1. You will notice that there is a Sign Message banner. It's already active.
  1. Write your message and when you are done, send it.
  2. Kmail will ask for you to type the secret passphrase that you made during the gpg --gen-key step. Type it in, and then Kmail will show you a confirmation window of the signed message. Click OK to send it.
  3. If you test it by sending to yourself, you will notice that Kmail displays the message with a GREEN header, with words like this: Message was signed by Fajar Priyanto (Knowledge is power! http://linux.arinet.org) (Key ID: 0x85EEC6A5). The signature is valid and the key is ultimately trusted.
  4. People that have your public key will have that display also, but those who don't have the key, will have the message displayed in yellow with words like this: Message was signed with unknown key 0xBFE7357F. The validity of the signature cannot be verified.

CONGRATULATIONS!

You now can communicate in a more secure way if you want to. I know this how-to is very short and might not be very clear. Well, please give me suggestions and I will improve it when the time comes. Also I intend to write the second part of this topic which covers how to ENCRYPT messages, import other public keys, and install Crypto Plug-ins. Special thanks to Tim Sawchuck and Philip Cronje and all my friends in the Mandrake List.


Issues

  • Messages signed by a key already known display correctly in KMail, but new keys were not being imported, and you can't sign messages. The culprit is a missing package. Installing pinentry-qt (you may need pinentry-qt4) appears to solve both problems.
  • KMail no longer does in-line signatures. GnuPG has to be used instead. KGPG is a useful application that helps in the management of signatures, both your own and those collected.

Note

To be sure the "passphrase agent" (gpg-agent) is enabled, check your ~/.gnupg/gpg.conf and eventually uncomment the line containing "use-agent".
In KMail's Settings -> Configure KMail -> Security tab -> Miscellaneous, select GnuPG Settings, then Configure. On the GPG Agent page, give a path to which logs can be written (Write server mode logs to FILE), in case of problems. You can check the log in KMail's Tools -> Filter Log Viewer. It's probably a good idea, too, to increase the cache time - I use 3600.


Warning

The following startup and shutdown scripts may be already in use from your distro, but not written in this path. Do not install these scripts unless you have problems with startup and shutdown


  • If you do not have it already, in ~/.config/plasma-workspace create a directory called env. In there, create a file called gpgagent.sh containing
#!/bin/bash
killall gpg-agent
eval `gpg-agent --daemon`

Save it and make it executable.

In the same way you would clean up gpg-agent on shutdown, so if you do not have it already, create another directory called shutdown into ~/.config/plasma-workspace and create in it another script file called stop_gpgagent.sh containing

#!/bin/bash
killall gpg-agent

Save it and make it executable.

Troubleshooting Tips

ps -edalf | grep gpg-agent

will list any running instances of gpg-agent.

killall gpg-agent

stops all instances

eval "$(gpg-agent --daemon)"

will restart the agent

gpg-agent status

should tell you if the agent is running.

More Information