Skip to content

Instantly share code, notes, and snippets.

@jewzaam
Last active October 22, 2019 18:51
Show Gist options
  • Save jewzaam/d5b9b0a850d438ac76f567a32097c654 to your computer and use it in GitHub Desktop.
Save jewzaam/d5b9b0a850d438ac76f567a32097c654 to your computer and use it in GitHub Desktop.
sre gpg sop

6.1. GPG (PGP)

As an ops person, you need a GPG key associated with your @redhat.com email address and distributed to a public keyserver such as pgp.mit.edu.

More information on specific steps can currently be found starting here, or via a web search: https://www.gnupg.org/gph/en/manual/c14.html

If you are creating a new GPG key, make sure it's 4096 bits long. If you're sure you want to re-use an existing key, you may do so. 4096 bits is preferred, and you must also ensure the key has been adequately secured and protected over it's entire life to date.

You should use your discretion and security best practices to protect your GPG key as you wish (e.g. pregenerate a revocation certificate, manage key expiration dates, etc).

The very abbreviated sequence of steps that you need to take is to create a new key, work with other ops-people to sign your key, and upload the result (your signed public key) to a public keyserver.

There are many walk-throughs available online on how to do this in more detail.

 $ gpg --gen-key
 ...
 $ gpg --sign-key ...
 ...
 $ gpg --keyserver pgp.mit.edu --send-key 0xKEY_ID

No credentials (either yours, or for a system you're configuring) should ever be sent to you in plain text. If this happens, ask for them to be regenerated and provided via GPG.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment