Usage on a GUI-less server

[szszszsz]

Hi!

Is it possible to use nitrocli in a GUI-less / init 3 Linux environment? I tried to simulate it in an Ubuntu 19.04 Docker container, and got this error:

root@a1f753f5d989:/# nitrocli pws get 0
83918950 Inappropriate ioctl for device <Pinentry>

Any ideas? Pinentry run separately works apparently. Getting status from the Storage device works as well. gpg-connect-agent also seems to work.

I tried to use /usr/bin/pinentry-tty (as here), but got other error:

83886340 Invalid IPC response <Pinentry>

Perhaps, alternatively, is it possible to disable gpg-connect-agent usage, and make nitrocli ask the PIN directly? E.g. via some kind of switch?

Full install and execution log attached:
nitrocli.init3.log

Connected: support request.

[d-e-s-o]

For me it works in a non-X11 environment. pinentry falls back to pinentry-curses and I can enter the password as usual. It also does what it is supposed to do with pinentry-tty.

I think what ultimately should be tried is something like:

$ gpg-connect-agent 'GET_PASSPHRASE --data X error secret+please just+a+test' /bye
> 
>  *** error ***
> 
> just a test
> secret please:
> D test
> OK

which is pretty much what we use. My guess would be that this fails in the same way. If it doesn't that would be very interesting.

In the past, I've had luck with:

gpg-connect-agent updatestartuptty /bye

in a slightly different scenario (when GPG was started on a different tty), so running that may be worth a shot (but judging from the logs you provided I am not sure that's the case here).

Also, my notes suggest that:

export GPG_TTY=$(tty)

helped me at some point with exactly this error message. That's more shots in the dark than anything else, though, or at least I don't see a clear connection in this case.

Perhaps, alternatively, is it possible to disable gpg-connect-agent usage, and make nitrocli ask the PIN directly? E.g. via some kind of switch?

We more or less intentionally don't have that. pinentry should support all the scenarios we are interested in and should integrate nicely into the system, so I didn't see the need.

[szszszsz]

Thank you for the check and thorough response! It looks clearer for me now. Closing, since it works on your side.