<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
Thanks for helping me interpret this logs !<br>
So I activited logs one component after the other, and finally the
problem was simply in libpam-poldi configuration...<br>
The opening parenthesis (before "public-key" keyword) was missing in
the key file :<br>
<br>
<span style="font-family:monospace"><span
style="color:#000000;background-color:#ffffff;">public-key</span><span
style="color:#000000;background-color:#ffffff;">
</span><br>
<span style="color:#000000;background-color:#ffffff;"> (rsa etc...</span><br>
<span style="color:#000000;background-color:#ffffff;">
</span><br>
</span>Well... embarrassing :-)<br>
But it least I progressed in the understanding of this stack !<br>
<br>
Thanks again,<br>
Franck<br>
<br>
<div class="moz-cite-prefix">Le 12/11/2025 à 22:32, Ingo Klöcker a
écrit :<br>
</div>
<blockquote type="cite" cite="mid:2762673.lGaqSPkdTl@daneel">
<pre wrap="" class="moz-quote-pre">On Mittwoch, 12. November 2025 22:07:15 Mitteleuropäische Normalzeit Franck
Routier (Personnel) via Gnupg-users wrote:
</pre>
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">I managed to get some logs from gpg-agent. No sure how to interpret this
however. No obvious error I can spot (but I don't know what to look for):
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">[...]
</pre>
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">2025-11-12 22:00:31 gpg-agent[16056] DBG: chan_12 -> OK Pleased to meet
you, process 16072
2025-11-12 22:00:31 gpg-agent[16056] DBG: chan_12 <- SCD GETINFO socket_name
2025-11-12 22:00:31 gpg-agent[16056] no running /usr/lib/gnupg/scdaemon
daemon - starting it
2025-11-12 22:00:31 gpg-agent[16056] DBG: agent_flush_cache (pincache only)
2025-11-12 22:00:31 gpg-agent[16056] DBG: chan_13 <- OK GNU Privacy
Guard's Smartcard server ready
2025-11-12 22:00:31 gpg-agent[16056] first connection to daemon
/usr/lib/gnupg/scdaemon established
2025-11-12 22:00:31 gpg-agent[16056] DBG: chan_13 -> GETINFO socket_name
2025-11-12 22:00:31 gpg-agent[16056] DBG: chan_13 <- D
/run/user/1000/gnupg/S.scdaemon
2025-11-12 22:00:31 gpg-agent[16056] DBG: chan_13 <- OK
2025-11-12 22:00:31 gpg-agent[16056] DBG: additional connections at
'/run/user/1000/gnupg/S.scdaemon'
2025-11-12 22:00:31 gpg-agent[16056] DBG: chan_13 -> OPTION event-signal=12
2025-11-12 22:00:31 gpg-agent[16056] DBG: chan_13 <- OK
2025-11-12 22:00:31 gpg-agent[16056] DBG: chan_13 -> GETINFO socket_name
2025-11-12 22:00:31 gpg-agent[16056] DBG: chan_13 <- D
/run/user/1000/gnupg/S.scdaemon
2025-11-12 22:00:31 gpg-agent[16056] DBG: chan_13 <- OK
2025-11-12 22:00:31 gpg-agent[16056] DBG: chan_12 -> D
/run/user/1000/gnupg/S.scdaemon
2025-11-12 22:00:31 gpg-agent[16056] DBG: chan_12 -> OK
2025-11-12 22:00:31 gpg-agent[16056] DBG: chan_12 <- BYE
2025-11-12 22:00:31 gpg-agent[16056] DBG: chan_12 -> OK closing connection
2025-11-12 22:00:31 gpg-agent[16056] DBG: chan_13 -> RESTART
2025-11-12 22:00:31 gpg-agent[16056] DBG: chan_13 <- OK
Trying to sudo at 22:00:31
Before is just normal gpg-agent start (?).
Any idea ?
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">
What we see above for chan_12 looks like the communication between libpam-
poldi (?) and gpg-agent. libpam-poldi asks scdaemon via gpg-agent for its
socket (SCD GETINFO socket_name). Then for chan_13 we see how gpg-agent talks
to scdaemon (that it first started) to ask scdaemon for its socket (GETINFO
socket_name) which replies with /run/user/1000/gnupg/S.scdaemon and OK. I
don't understand the "additional connections ..." message and the other chat
on chan_13. In any case, on chan_12 gpg-agent sends the socket back to libpam-
poldi which then ends the connection with BYE.
My guess is that libpam-poldi asked gpg-agent for the socket of scdaemon so
that it can subsequently talk to scdaemon directly. You might want to add
'debug ipc' to scdaemon.conf to capture the communication of scdaemon with
other processes.
Regards,
Ingo
</pre>
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">Le 07/11/2025 à 18:36, Franck Routier (Personnel) via Gnupg-users a écrit :
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">Typo? In any case, avoid the weird debug-level setting. Use "debug ipc"
instead. Also set log-file so that the logs don't end up in some random
place (or nowhere).
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">
Yes typo. I removed it alltogether for now:
pinentry-program /usr/bin/pinentry-qt
enable-ssh-support
ttyname $GPG_TTY
default-cache-ttl 60
max-cache-ttl 120
</pre>
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">Very likely gpg-agent fails to start pinentry-qt or pinentry-qt fails to
start because there's no window manager running. Try using
pinentry-curses or pinentry-tty instead of pinentry-qt if you are anyway
using the terminal.>
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">In fact gpg-agent seems to be able to call pinentry-qt, as when I use
pass or browserpass, it works and I get a pretty pinentry window...
That said, switching to pinentry-tty does not solve the problem with pam.
In fact I can see pinentry-tty working with pass and failing with sudo
in the same terminal session:
$ pass perso/ameli.fr
Please unlock the card
Number: 10 955 601
Holder: Franck Routier
PIN:
*************************
$ sudo su
Insert authentication card for user `franck'
Trying authentication as user `franck'...
[sudo] password for franck:
Franck
_______________________________________________
Gnupg-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Gnupg-users@gnupg.org">Gnupg-users@gnupg.org</a>
<a class="moz-txt-link-freetext" href="https://lists.gnupg.org/mailman/listinfo/gnupg-users">https://lists.gnupg.org/mailman/listinfo/gnupg-users</a>
</pre>
</blockquote>
</blockquote>
<pre wrap="" class="moz-quote-pre">
</pre>
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
<pre wrap="" class="moz-quote-pre">_______________________________________________
Gnupg-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Gnupg-users@gnupg.org">Gnupg-users@gnupg.org</a>
<a class="moz-txt-link-freetext" href="https://lists.gnupg.org/mailman/listinfo/gnupg-users">https://lists.gnupg.org/mailman/listinfo/gnupg-users</a>
</pre>
</blockquote>
<br>
</body>
</html>