Fw: GnuPG - Encryption process issues.

Carlos Alberto Moreno Torres cmorenot at mx1.ibm.com
Mon Jun 6 19:34:04 CEST 2016


Hi Ankit,

Below is the response from GnuPG support, please let us know if this can
provide us the specific Root Cause. Please reply to all and direct email to
GnuPG Team if you have any questions for them. Thanks in advance.

Also, do not remove any of the participants of this email.

                                Hi Carlos--

   Please reply in the original thread, to make it easier for people to
                          follow the discussion.

  I've added some References: headers back in here so some mailers might
           merge the threads, but this won't work for everyone.

       Also, when sharing terminal transcripts, sending mail without
 unnecessary line-wrapping will make them much easier for your readers to
                                interpret.

  It looks like you're trying to sign the file (that's what the "-s" part
 of "-se" means).  For whatever reason, the signature itself is likely to
  be what is failing, and not the encryption.  If you drop the signatures
 in your test (using -e instead of -se) do they all complete cleanly?  To
      be clear: I'm not saying you shouldn't sign at the same time as
 encrypting, i'm trying to help you narrow down the cause of the problem.

   I also see you fiddling with the ownership of ~/.gnupg/random_seed --
 you really shouldn't need to do that, and ideally each user will control
  their own random_seed automatically -- you shouldn't be sharing a gnupg
  home directory between to different user accounts unless you absolutely
                                 need to.

                                     --dkg
                    (See attached file: signature.asc)





   Carlos A. Moreno Torres
    Problem Management | CEMEX
    Global Technology Services | IBM Corporation
                                                                                         
                                                                                         
                                                                                         
   Office: (+52-81) 8328-5251                                                        IBM 
   E-mail: cmorenot at mx1.ibm.com                            Av. Constitución No. 444 Pte. 
   IBM @ CEMEX Collaboration HUB: ibm.biz/Bdx93b                     Monterrey, NL 64000 
                                                                                  México 
                                                                                         
                                                                                         
                                                                                         






From:	Ankit Bhardwaj5/India/IBM
To:	Carlos Alberto Moreno Torres/Mexico/Contr/IBM at IBMMX
Cc:	Ajay B Challa/India/IBM at IBMIN, Ivan Fernando Montes de Oca
            Tavera/Mexico/Contr/IBM at IBMMX, "Juan Carlos Garcia"
            <juancarlos.garcia at ext.cemex.com>, Samuel Ramos
            Javier/Mexico/IBM at IBMMX, "Samuel Mizrain Ramos Javier"
            <samuelmizrain.ramos at ext.cemex.com>, Srinivas
            Masetty/India/IBM at IBMIN
Date:	05/31/2016 10:46 AM
Subject:	Re: Fw: GnuPG - Encryption process issues.


Hello Carlos

Please share below information with GPG team i think by seeing the results
of test performed by us on system they will able to give us the solution

We have tested below things in envirnoment

-> Userd Details used in this test
root
ehpadm

Permissions under user "root"

-> Directory Permission of root

drwx------    2 root     sapsys         4096 May 31 09:39 /home/root/.gnupg

-> Files Under /home/root/.gnupg

-rw-------    1 root     sapsys         1280 Sep 13 2011  trustdb.gpg
-rw-------    1 root     sapsys         4805 Sep 13 2011  secring.gpg
-r--------    1 root     sapsys         9088 Sep 13 2011  gpg.conf
-rw-------    1 root     sapsys         7438 May 21 2013  pubring.gpg~
-rw-------    1 root     sapsys         8557 Nov  8 2013  pubring.gpg
-rw-------    1 root     sapsys           11 Apr 28
08:44 .#lk200104a8.mxoccsapehpn2.8716480
-rw-------    1 root     sapsys           11 Apr 28
08:53 .#lk2000c2c8.mxoccsapehpn2.11141460
-rw-------    1 root     sapsys           11 Apr 28
12:00 .#lk200104b8.mxoccsapehpn2.8978598
-rw-------    1 root     sapsys           11 Apr 29
08:57 .#lk2000c2c8.mxoccsapehpn2.12911042
-rw-------    1 root     sapsys           11 May  2
11:32 .#lk200104b8.mxoccsapehpn2.10748294
-rw-------    1 root     sapsys           11 May  2
19:34 .#lk200104b8.mxoccsapehpn2.7471568
-rw-------    1 root     sapsys           11 May  2
22:23 .#lk2000c328.mxoccsapehpn2.12058746
-rw-------    1 root     sapsys           11 May  2
23:46 .#lk200104b8.mxoccsapehpn2.6750230
-rw-------    1 root     sapsys           11 May  3
10:28 .#lk200104b8.mxoccsapehpn2.14221392
-rw-------    1 root     sapsys           11 May  3
13:45 .#lk200104b8.mxoccsapehpn2.9240874
-rw-------    1 root     sapsys          600 May 31 09:39 random_seed


->Permissions under user "ehpadm"

drwx------    2 ehpadm   sapsys         4096 May 31
09:48 /home/ehpadm/.gnupg

-> Files Under /home/ehpadm/.gnupg

-rw-------    1 ehpadm   sapsys         1200 May  3 21:54 trustdb.gpg
-rw-------    1 ehpadm   sapsys         7438 May  3 21:54 pubring.gpg~
-rw-------    1 ehpadm   sapsys         8557 May  3 21:54 pubring.gpg
-rw-------    1 ehpadm   sapsys         4805 May  3 21:54 secring.gpg
-rw-------    1 ehpadm   sapsys           11 May  3
22:03 .#lk200104b8.mxoccsapehpn2.6488076
-rw-------    1 ehpadm   sapsys         9029 May  4 11:18 gpg.conf
-rw-------    1 ehpadm   sapsys           11 May  4
13:43 .#lk2000c328.mxoccsapehpn2.6160766
-rw-------    1 ehpadm   sapsys           11 May  4
13:55 .#lk2000c328.mxoccsapehpn2.8913004
-rw-------    1 ehpadm   sapsys           11 May  4
15:55 .#lk2000c328.mxoccsapehpn2.12976528
-rw-------    1 ehpadm   sapsys           11 May  4
17:58 .#lk2000c328.mxoccsapehpn2.10158578
-rw-------    1 ehpadm   sapsys           11 May  4
18:06 .#lk2000c328.mxoccsapehpn2.5308674
-rw-------    1 ehpadm   sapsys            0 May 31 10:00 random_seed




#### Test 1 ##### -------Failed Test

->Created file name "testehpadm" in ehpadm home directory
-rw-r--r--    1 ehpadm   sapsys            6 May 31
10:06 /home/ehpadm/testehpadm

-> Invoke GPG progrma using below command
/opt/freeware/gnupg/bin/gpg -v -u cxcxmxmt-py -se --armor
--output /home/ehpadm/testehpadm.pgp -r HSBCnet******2020-07-20
--trust-model always /home/ehpadm/testehpadm

-> Output of command
gpg: using subkey B6BC9FE5 instead of primary key D8F5ECAE
gpg: No trust check due to `--trust-model always' option
gpg: writing to `/home/ehpadm/testehpadm.pgp'

-> command is not exiting , we have to forecfully kill the command every
time and file generated by PGP is zero bytes

-rw-r--r--    1 ehpadm   sapsys            0 May 31
10:06 /home/ehpadm/testehpadm.pgp


#### Test 2 ##### --------Successful Test

->Created file name "testroot" in root home directory
-rw-r--r--    1 root     system            7 May 31
10:11 /home/root/testroot

-> Invoke GPG progrma using below command
/opt/freeware/gnupg/bin/gpg -v -u cxcxmxmt-py -se --armor
--output /home/root/testroot.pgp -r HSBCnet******2020-07-20 --trust-model
always /home/root/testroot

-> Output of command
gpg: using subkey B6BC9FE5 instead of primary key D8F5ECAE
gpg: No trust check due to `--trust-model always' option
gpg: writing to `/home/root/testroot.pgp'
gpg: RSA/AES256 encrypted for: "B6BC9FE5 HSBCnet******2020-07-20"
gpg: RSA/SHA1 signature from: "5FBFB2DF cxcxmxmt-py (exp:2026-07-22)"

Test completed successfully with no errors
-rw-r--r--    1 root     system         1649 May 31
10:12 /home/root/testroot.pgp

#### Test 3 ##### ---------Test is successful but giving some error

->Created file name "testehpadm" in ehpadm home directory
-rw-r--r--    1 ehpadm   sapsys            6 May 31
10:06 /home/ehpadm/testehpadm

-> Changed the owner of "random seed" file to root so that ehpadm can not
write to random_seed file
-rw-------    1 root     system            0 May 31
10:00 /home/ehpadm/.gnupg/random_seed

-> Invoke GPG progrma using below command
/opt/freeware/gnupg/bin/gpg -v -u cxcxmxmt-py -se --armor
--output /home/ehpadm/testehpadm.pgp -r HSBCnet******2020-07-20
--trust-model always /home/ehpadm/testehpadm



-> Output of command
gpg: using subkey B6BC9FE5 instead of primary key D8F5ECAE
gpg: No trust check due to `--trust-model always' option
File `/home/ehpadm/testehpadm.pgp' exists. Overwrite? (y/N) y
gpg: writing to `/home/ehpadm/testehpadm.pgp'
gpg: can't open `/home/ehpadm/.gnupg/random_seed': Permission denied
gpg: RSA/AES256 encrypted for: "B6BC9FE5 HSBCnet******2020-07-20"
gpg: RSA/SHA1 signature from: "5FBFB2DF cxcxmxmt-py (exp:2026-07-22)"
gpg: note: random_seed file not updated


-> command is exiting successfully , but below errors are coming
gpg: can't open `/home/ehpadm/.gnupg/random_seed': Permission denied
gpg: note: random_seed file not updated

Encrypted file is generated
-rw-r--r--    1 ehpadm   sapsys         1654 May 31
10:25 /home/ehpadm/testehpadm.pgp


So when we have original random seed file in home directory of ehpadm user,
gpg encryption program is not working and when we change the owner of this
file and make root as the owner gpg
is bypassing this file and it generated the encypted file with below error
as in TEST 3

gpg: can't open `/home/ehpadm/.gnupg/random_seed': Permission denied
gpg: note: random_seed file not updated


                                                                                   
 Regards,                                                                          
                                                                                   
 ANKIT BHARDWAJ                                                                    
 SME - AIX                                                                         
                                                                                   


                                                                                     
                                                                                     
                                                                                     
 Mobile: 91-9000-146341                                                          IBM 
 E-mail: ankit.bhardwaj3 at in.ibm.com                                                  
                                                                                     







From:	Carlos Alberto Moreno Torres/Mexico/Contr/IBM
To:	Ankit Bhardwaj5/India/IBM at IBMIN
Cc:	"Juan Carlos Garcia" <juancarlos.garcia at ext.cemex.com>,
            Srinivas Masetty/India/IBM at IBMIN, Ajay B
            Challa/India/IBM at IBMIN, Samuel Ramos Javier/Mexico/IBM at IBMMX,
            "Samuel Mizrain Ramos Javier"
            <samuelmizrain.ramos at ext.cemex.com>, Ivan Fernando Montes de
            Oca Tavera/Mexico/Contr/IBM at IBMMX
Date:	05/31/2016 07:11 PM
Subject:	Fw: GnuPG - Encryption process issues.


Hi Ankit,

Please confirm if information provided by GnuPG Support Team lead us to a
specific Root Cause or if more details are required, since issue can occur
again, generating another RCA with higher visibility.

Thanks in advance.


   Carlos A. Moreno Torres
    Problem Management | CEMEX
    Global Technology Services | IBM Corporation
                                                                                         
                                                                                         
                                                                                         
   Office: (+52-81) 8328-5251                                                        IBM 
   E-mail: cmorenot at mx1.ibm.com                            Av. Constitución No. 444 Pte. 
   IBM @ CEMEX Collaboration HUB: ibm.biz/Bdx93b                     Monterrey, NL 64000 
                                                                                  México 
                                                                                         
                                                                                         
                                                                                         



----- Forwarded by Carlos Alberto Moreno Torres/Mexico/Contr/IBM on
05/31/2016 08:36 AM -----

From:	Carlos Alberto Moreno Torres/Mexico/Contr/IBM
To:	"Juan Carlos Garcia" <juancarlos.garcia at ext.cemex.com>, Juan
            Carlos Garcia Dominguez/Mexico/Contr/IBM at IBMMX, Ankit
            Bhardwaj5/India/IBM at IBMIN
Cc:	Samuel Ramos Javier/Mexico/IBM at IBMMX, "Samuel Mizrain Ramos
            Javier" <samuelmizrain.ramos at ext.cemex.com>, Ivan Fernando
            Montes de Oca Tavera/Mexico/Contr/IBM at IBMMX
Date:	05/27/2016 03:05 PM
Subject:	Fw: GnuPG - Encryption process issues.


FYI



   Carlos A. Moreno Torres
    Problem Management | CEMEX
    Global Technology Services | IBM Corporation
                                                                                         
                                                                                         
                                                                                         
   Office: (+52-81) 8328-5251                                                        IBM 
   E-mail: cmorenot at mx1.ibm.com                            Av. Constitución No. 444 Pte. 
   IBM @ CEMEX Collaboration HUB: ibm.biz/Bdx93b                     Monterrey, NL 64000 
                                                                                  México 
                                                                                         
                                                                                         
                                                                                         



----- Forwarded by Carlos Alberto Moreno Torres/Mexico/Contr/IBM on
05/27/2016 03:04 PM -----

From:	Daniel Kahn Gillmor <dkg at fifthhorseman.net>
To:	Carlos Alberto Moreno Torres/Mexico/Contr/IBM at IBMMX,
            gnupg-users at gnupg.org
Date:	05/27/2016 10:32 AM
Subject:	Re: GnuPG - Encryption process issues.



On Tue 2016-05-24 16:09:21 -0400, Carlos Alberto Moreno Torres wrote:

> In recent days, Human Resources Department had some issues while using
the
> Encryption Program GnuPG in payroll activities, this issue caused a delay
> since files where encrypted but information was in blank (like if
> encryption process did not finish.)
>
> As part of remediation process, we found out that it could only work with
> Root Permissions but not with the current user. We want to confirm how
does
> the encryption process works and if you can share any thoughts of what
> might could happen. If you require more information, please do not
hesitate
> to ask me.

It sounds to me like the installation of gnupg that you are using is
misconfigured.  GnuPG depends heavily on a "keyring" -- a collection of
public key material (and sometimes private key material, if decryption
or signing is needed), which it maintains in the .gnupg directory within
the running user's home directory (found by the environment variable
$HOME).

If you've started with a normal user account, but have then run gnupg as
root (e.g. using "su") without resetting $HOME to root's actual homedir
(usually /root on the systems i use), then it's possible that you've
created ~/.gnupg with the wrong permissions.

Or, it's possible that the .gnupg directory is *only* available within
root's homedir.

Does your non-privileged user have a ~/.gnupg directory?  if so, does it
have read and write access to it?

What error messages do you get from invoking gpg directly?

     --dkg






-------------- next part --------------
An HTML attachment was scrubbed...
URL: </pipermail/attachments/20160606/27598f09/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0F237791.gif
Type: image/gif
Size: 2022 bytes
Desc: not available
URL: </pipermail/attachments/20160606/27598f09/attachment-0002.gif>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: graycol.gif
Type: image/gif
Size: 105 bytes
Desc: not available
URL: </pipermail/attachments/20160606/27598f09/attachment-0003.gif>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/octet-stream
Size: 966 bytes
Desc: not available
URL: </pipermail/attachments/20160606/27598f09/attachment-0001.obj>


More information about the Gnupg-users mailing list