Score:0

Proper way to set up or change a preferred gpg keyserver in ubuntu 20.04?

us flag

I am using ubuntu server 20.04. I am attempting to download developer public gpg/pgp keys from keyservers. For many of the keys that I want, they don't seem to be listed on ubuntu's default key servers. The ones that are listed, don't seem to be accurate or otherwise seem outdated or expired. What I want to do is, when trying to download a public key on ubuntu, make ubuntu default towards looking up the requested key from the most stringent (email requirement wise) keyserver (https://keys.openpgp.org/) first, and then, if not found, to automatically look up the key from a more lax and more compatable keyserver (hkp://pool.sks-keyservers.net).

The first issue I have, is that I can't find any settings in the terminal where ubuntu stores its default permanent key-server addresses when doing key lookups/downloads. So, my questions are:

  1. Where is the default ubuntu keyserver setting located (what file can I modify to change the default keyserver permanently in ubuntu?)?
  2. How Can I set 2 keyservers (in ubuntu) with their order being their preference in which ubuntu places requests to them? Such that keyserver1=https://keys.openpgp.org/ and keyserver2=hkp://pool.sks-keyservers.net, so that if a key cannot be found on keyserver1, then ubuntu searches for the key on keyserver2?

Thanks for any help!

Score:1
de flag

Where is the default ubuntu keyserver setting located (what file can I modify to change the default keyserver permanently in ubuntu?)?

By default this is in ~/.gnupg/gpg.conf. If you do not have this file/directory, you can invoke gpg --version in order to see where your copy of GPG is set to store its configuration.

How Can I set 2 keyservers (in ubuntu) with their order being their preference in which ubuntu places requests to them? Such that keyserver1=https://keys.openpgp.org/ and keyserver2=hkp://pool.sks-keyservers.net, so that if a key cannot be found on keyserver1, then ubuntu searches for the key on keyserver2?

In the configuration file, which includes instructions as a comment, you will find the following:

> # GnuPG can automatically locate and retrieve keys as needed using the
> # auto-key-locate option.  This happens when encrypting to an email
> # address (in the "[email protected]" form), and there are no
> # [email protected] keys on the local keyring.  This option takes the
> # following arguments, in the order they are to be tried:
> # 
> # cert = locate a key using DNS CERT, as specified in RFC-4398.
> #        GnuPG can handle both the PGP (key) and IPGP (URL + fingerprint)
> #        CERT methods.
> #
> # pka = locate a key using DNS PKA.
> #
> # ldap = locate a key using the PGP Universal method of checking
> #        "ldap://keys.(thedomain)".  For example, encrypting to
> #        [email protected] will check ldap://keys.example.com.
> #
> # keyserver = locate a key using whatever keyserver is defined using
> #             the keyserver option.
> #
> # You may also list arbitrary keyservers here by URL.

The relevant part is the fifth line: "in the order they are to be tried"

DanRan avatar
us flag
This is a great answer! Thank you very much @James S.
James S. avatar
de flag
Happy to help. :D
DanRan avatar
us flag
Shucks. I still need help. I'm just going over this again now on ubuntu 20.04 server, and there is no gpg.conf file in my ~/.gnupg directory, even though `gpg --version` shows `/home/danran/.gnupg` as my gnupg home directory. Why is this missing and how can I find or re-create the default gpg.conf file in my ~/.gnupg folder?
James S. avatar
de flag
Sorry for the delay. This answer: https://unix.stackexchange.com/a/654980/70510 tells you what you need, then just add the parts that we have discussed above. GL!
DanRan avatar
us flag
Thank you! i ended up grabbing a hardened gpg.conf from dr. duh https://github.com/drduh/config/blob/master/gpg.conf
James S. avatar
de flag
Huzzah! Victory!
Score:0
us flag

Unfortunately, I could not find my gpg.conf file anywhere. So in order to get a hardened gpg configuration file, I downloaded a Hardened gpg.conf file from Dr.Duh's github page at github.com/drduh/config/blob/master/gpg.conf

Then I modified it to include the keyservers of my desire, in the order I want Mac OS to read them, with the keyserver at the top, being the first one macOS reads.

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.