KMail/PGP MIME

Other languages:

Configurar els missatges signats amb GPG en Kmai

per Dawn Priyanto, 2004

Crear, realitzar còpies de seguretat, i la publicació de la vostra clau

1. Us cal el programa gpg. Per omissió ja està instal·lat.

2. Creeu la vostra pròpia clau (escriu-viu això com a usuari, no com a root):

gpg --gen-key

Seguiu les instruccions, és molt clar i fàcil.

3. Comproveu que ja està creada:

gpg --list-key

Veureu alguna cosa com això amb les vostres pròpies credencials:

:pub 1024D/85EEC6A5 2004-03-15 Fajar Priyanto (Knowledge is power! http://linux.arinet.org) sub 1024g/BBBB57F3 2004-03-15

4. Mireu per sobre dels detalls. Per exemple 85EEC6A5 és el vostre ID de la clau. Ara, amb la finalitat d'exportar la clau pública:

:gpg -ao fajar-pub.key --export 85EEC6A5

Es crearà un fitxer anomenat fajar-pub.key en el directori actual. Aquest és una còpia de la vostra clau pública. També és el fitxer que la gent ha d'importar per verificar els vostres missatges de correu electrònic signats. Es pot publicar en servidors de claus de tot el món, o es pot enviar directament a les persones que ho demanin, o es pot posar al vostre lloc web perquè altres el puguin descarregar.

Si ens fixem en el fitxer, serà com això:

-- --BEGIN PGP PUBLIC KEY BLOCK-- --

Version: GnuPG v1.2.3 (GNU/Linux)

mQGiBEBVTw8RBACaYvnDkgqNWyktg3urdE9mrpv63x3Iux2zVkuZk8pIRp5HeR/V

[més...]

B394acuU4FdGN/EynYUAn1aRvNmgs0/IU2MDzYQpbHIaqpkE

=B0cy

-- --END PGP PUBLIC KEY BLOCK-- --

A més, possiblement vulgueu fer una còpia de seguretat de la clau secreta a un mitjà segur (no només un disc: aquests es malmeten), podeu utilitzar la següent ordre:

$ gpg -ao secret.asc --export-secret-keys 85EEC6A5

Això crearà un fitxer de text que conté la vostra clau secreta o privada, amb el nom secret.asc. No la lliureu a algú del que no confieu en un 100%. Amagueu-la en un lloc segur (o millor, en més d'un).

Finally, it is advisable to generate a revocation certificate and store it in a safe place away from your secret key. In case your secret key gets into the wrong hands, you can revoke it so it can not easily be abused by others. The command to do this is

$ gpg -a -o revoker.asc --gen-revoke 85EEC6A5

This will create a textfile with the name revoker.asc containing the revocation certificate.

Configurar Kmail per signar missatges de correu electrònic utilitzant la clau GPG

Fire up Kmail, and go to Settings -> Configure KMail -> Identities
Choose the identity that you are using
Then click Modify -> Cryptography -> OpenPGP signing key
It will automatically show your gpgkey, that is 85EEC6A5
If it will not, click Change..., choose key ID then click OK
Now, set up Kmail to automatically sign all emails that you write using your key
Still in the Kmail Configure menu, go to Security -> Composing
Tick mark these:
1. Store sent messages encrypted,
2. Always show the encryption key for approval,
3. Automatically sign messages
Exit the configuration menu by clicking OK.

Provar Kmail creant un nou missatge

You will notice that there is a Sign Message icon right after the paperclip (attachment) icon. It's already active.
Write your message and when you are done, send it.
Kmail will ask for you to type the secret passphrase that you made during the gpg --gen-key step. Type it in, and then Kmail will show you a confirmation window of the signed message. Click OK to send it.
If you test it by sending to yourself, you will notice that Kmail displays the message with a GREEN header, with words like this: Message was signed by Fajar Priyanto (Knowledge is power! http://linux.arinet.org) (Key ID: 0x85EEC6A5). The signature is valid and the key is ultimately trusted.
People that have your public key will have that display also, but those who don't have the key, will have the message displayed in yellow with words like this: Message was signed with unknown key 0xBFE7357F. The validity of the signature cannot be verified.

ENHORABONA!

You now can communicate in a more secure way if you want to. I know this how-to is very short and might not be very clear. Well, please give me suggestions and I will improve it when the time comes. Also I intend to write the second part of this topic which covers how to ENCRYPT messages, import other public keys, and install Crypto Plug-ins. Special thanks to Tim Sawchuck and Philip Cronje and all my friends in the Mandrake List.

Problemes

Messages signed by a key already known display correctly in KMail, but new keys were not being imported, and you can't sign messages. The culprit is a missing package. Installing pinentry-qt (you may need pinentry-qt4) appears to solve both problems.

KMail no longer does in-line signatures. OpenGPG has to be used instead. KGpg is a useful applet that helps in the management of signatures, both your own and those collected.

If OpenGPG is functioning correctly you will have to give the pass-phrase every time you send a document that is to be signed. This soon becomes a pain, and the way out of that is to configure gpg-agent, which comes with kdebase-common package. Unfortunately, the install does not pick up the need for pinentry-qt(4) or pinentry-gtk (KDE or GNOME), so that has to be installed separately. The config file for gpg-agent is written to by KMail's settings.

Note

To be sure the "passphrase agent" (gpg-agent) is enabled, check your ~/.gnupg/gpg.conf and eventually uncomment the line containing "use-agent".
In KMail's Settings -> Configure KMail -> Security tab -> Crypto Backends, select OpenGPG, then Configure. On the GPG Agent page, give a path to which logs can be written, in case of problems. You can check the log in KMail's Tools -> GnuPG Log Viewer. It's probably a good idea, too, to increase the cache time - I use 3600.

Warning

The following startup and shutdown scripts may be already in use from your distro, but not written in this path. Do not install these scripts unless you have problems with startup and shutdown

If you do not have it already, in ~/.kde create a directory called env. In there, create a file called gpgagent.sh containing

#!/bin/bash
killall gpg-agent
eval `gpg-agent --daemon`

Deseu i feu-lo executable.

In the same way you would clean up gpg-agent on shutdown, so if you do not have it already, create another directory called shutdown into ~/.kde and create in it another script file called stop_gpgagent.sh containing

#!/bin/bash
killall gpg-agent

Deseu i feu-lo executable.

Consells per a la resolució de problemes

 grep gpg-agent

mostrarà una llista d'instàncies en execució de gpg-agent.

killall gpg-agent

aturarà totes les instàncies.

eval "$(gpg-agent --daemon)"

tornarà a iniciat l'agent.

gpg-agent status

us dirà si l'agent està en execució.

Veure també:

La pàgina Resum on hi ha més consells i trucs.