Forwarding gpg-agent to a remote system over SSH
You need at least GnuPG 2.1.1 on both systems.
Edit your gpg-agent.conf to configure an extra socket. The extra socket is more restricted then the normal socket and Pinentry messages will differ when gpg-agent is accessed over this socket:
Replace <user> with your actual username.
GnuPG on the remote system
It is important to note that to work properly GnuPG on the remote system still needs your public keys. So you have to make sure they are available on the remote system even if your secret keys are not.
Note: With GnuPG >= 2.1.13 the location of the agents socket changed. To find out the name of the socket, always use:
gpgconf --list-dir agent-extra-socket
OpenSSH >= 6.7
To your /.ssh/config you can add:
Host gpgtunnel HostName server.domain RemoteForward /home/<user>/.gnupg/S.gpg-agent /home/<user>/.gnupg/S.gpg-agent.extra
If you can modify the servers settings you should put:
Into /etc/ssh/sshd_config to enable automatic removal of stale sockets when connecting to the remote machine. Otherwise you will first have to remove the socket on the remote machine before forwarding works.
Note: On Systems where systemd controls the directories under /var/run/user/<uid> it may be that the socket forwarding fails because /var/run/user/<uid>/gnupg is deleted on logout. To workaround this you can put gpgconf --create-socketdir in the startup script of your shell e.g. ~/.bashrc or ~/.zshrc.
Remote gpg will try to start gpg-agent if it's not running. Remote gpg-agent which will delete your forwarded socket and set up it's own. To avoid this you can pass --no-autostart to remote gpg command.
OpenSSH < 6.7
Before OpenSSH 6.7 you need to use socat which is a bit more fragile and requires a loop to stay open.
# Execute locally (while true; do socat TCP-LISTEN:16668,bind=127.0.0.1 UNIX-CONNECT:$HOME/.gnupg/S.gpg-agent.extra; done) & # Connect to the remote system with Port forwarding. ssh -R16668:localhost:16668 server.domain # Connect the socket on the remote system (while true; do socat UNIX-LISTEN:$HOME/.gnupg/S.gpg-agent,unlink-close,unlink-early TCP4:localhost:16668; done) &