Improve Split GPG documentation

[bnvk]

Trying configure Split GPG on my Qubes 3.1 install, I cannot get it to function. When I first started, I made sure I had qubes-gpg-split-dom0 installed in dom0. The Konsole said it was already installed, same for my Fedora 23 Template. However in Debian Standalone, I did need to install the package.

However, in none of the AppVMs that I added the QUBES_GPG_DOMAIN=my-vault value to seem to function. Running both gpg -K and gpg2 -K returns nothing and seems to only be accessing the keychain in that VM.

Upon double checking in dom0 that the package was installed, I now see the following error (even after restarting machine).

[user@dom0 ~]$ sudo qubes-dom0-update qubes-gpg-split-dom0
Using sys-whonix as UpdateVM to download updates for Dom0; this may take some time...
Running command on VM: 'sys-whonix'...
--> Running transaction check
---> Package qubes-gpg-split-dom0.x86_64 0:2.0.18-1.fc20 will be reinstalled
--> Finished Dependency Resolution
Existing lock /var/run/yum.pid: another copy is running as pid 3733.
Another app is currently holding the yum lock; waiting for it to exit...
  The other application is: PackageKit
    Memory :  43 M RSS (258 MB VSZ)
    Started: Sun Apr  3 12:29:30 2016 - 00:02 ago
    State  : Sleeping, pid: 3733
Another app is currently holding the yum lock; waiting for it to exit...
  The other application is: PackageKit
    Memory :  43 M RSS (258 MB VSZ)
    Started: Sun Apr  3 12:29:30 2016 - 00:04 ago
    State  : Sleeping, pid: 3733
Another app is currently holding the yum lock; waiting for it to exit...
  The other application is: PackageKit
    Memory :  43 M RSS (258 MB VSZ)
    Started: Sun Apr  3 12:29:30 2016 - 00:06 ago
    State  : Sleeping, pid: 3733
qubes-dom0-cached                                                                                                                      | 3.6 kB  00:00:00     
Package qubes-gpg-split-dom0-2.0.18-1.fc20.x86_64 already installed and latest version
Nothing to do
[user@dom0 ~]$ 

[marmarek]

However, in none of the AppVMs that I added the QUBES_GPG_DOMAIN=my-vault value to seem to function. Running both gpg -K and gpg2 -K returns nothing and seems to only be accessing the keychain in that VM.

That's expected behaviour. You need to call qubes-gpg-client-wrapper to
actually use split gpg. And configure applications you use to call this
instead of gpg/gpg2.

Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?

[marmarek]

However, in none of the AppVMs that I added the QUBES_GPG_DOMAIN=my-vault value to seem to function. Running both gpg -K and gpg2 -K returns nothing and seems to only be accessing the keychain in that VM.

That's expected behaviour. You need to call qubes-gpg-client-wrapper to
actually use split gpg. And configure applications you use to call this
instead of gpg/gpg2.

Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?

[bnvk]

@marmarek ah right, thanks for clarifying. I will tweak the docs page to make this a lil more clear!

[bnvk]

@marmarek ah right, thanks for clarifying. I will tweak the docs page to make this a lil more clear!

[mfc]

it would probably be useful in the documentation to have each step be numbered, to avoid these types of issues (I also had issues by accidentally skipping a step).

more generally, it may be good to also have a "good practices" section or something. for example, similar to a pgp smartcard, it probably makes sense to shutdown your split-gpg vm when you are away from your computer, in order to prevent potentially malicious vms from hammering your split-gpg to decrypt things (given the split-gpg access log has no timestamps).

[mfc]

it would probably be useful in the documentation to have each step be numbered, to avoid these types of issues (I also had issues by accidentally skipping a step).

more generally, it may be good to also have a "good practices" section or something. for example, similar to a pgp smartcard, it probably makes sense to shutdown your split-gpg vm when you are away from your computer, in order to prevent potentially malicious vms from hammering your split-gpg to decrypt things (given the split-gpg access log has no timestamps).