-COMMAND="$1"
-[ "$COMMAND" ] || failure "Type '$PGRM help' for usage."
-shift
-
-# set ms home directory
-MS_HOME=${MS_HOME:-"${HOME}/.config/monkeysphere"}
-
-# load configuration file
-MS_CONF=${MS_CONF:-"${MS_HOME}/monkeysphere.conf"}
-[ -e "$MS_CONF" ] && . "$MS_CONF"
-
-# set empty config variable with defaults
-GNUPGHOME=${GNUPGHOME:-"${HOME}/.gnupg"}
-KEYSERVER=${KEYSERVER:-"subkeys.pgp.net"}
-CHECK_KEYSERVER=${CHECK_KEYSERVER:="true"}
-KNOWN_HOSTS=${KNOWN_HOSTS:-"${HOME}/.ssh/known_hosts"}
-HASH_KNOWN_HOSTS=${HASH_KNOWN_HOSTS:-"true"}
-AUTHORIZED_KEYS=${AUTHORIZED_KEYS:-"${HOME}/.ssh/authorized_keys"}
-
-# other variables
-AUTHORIZED_USER_IDS=${AUTHORIZED_USER_IDS:-"${MS_HOME}/authorized_user_ids"}
-REQUIRED_HOST_KEY_CAPABILITY=${REQUIRED_HOST_KEY_CAPABILITY:-"a"}
-REQUIRED_USER_KEY_CAPABILITY=${REQUIRED_USER_KEY_CAPABILITY:-"a"}
-
+# unset variables that should be defined only in config file
+unset KEYSERVER
+unset CHECK_KEYSERVER
+unset KNOWN_HOSTS
+unset HASH_KNOWN_HOSTS
+unset AUTHORIZED_KEYS
+
+# load global config
+[ -r "${ETC}/monkeysphere.conf" ] && . "${ETC}/monkeysphere.conf"
+
+# set monkeysphere home directory
+MONKEYSPHERE_HOME=${MONKEYSPHERE_HOME:="${HOME}/.config/monkeysphere"}
+mkdir -p -m 0700 "$MONKEYSPHERE_HOME"
+
+# load local config
+[ -e ${MONKEYSPHERE_CONFIG:="${MONKEYSPHERE_HOME}/monkeysphere.conf"} ] && . "$MONKEYSPHERE_CONFIG"
+
+# set empty config variables with ones from the environment, or from
+# config file, or with defaults
+GNUPGHOME=${MONKEYSPHERE_GNUPGHOME:=${GNUPGHOME:="${HOME}/.gnupg"}}
+KEYSERVER=${MONKEYSPHERE_KEYSERVER:=${KEYSERVER:="subkeys.pgp.net"}}
+CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:=${CHECK_KEYSERVER:="true"}}
+KNOWN_HOSTS=${MONKEYSPHERE_KNOWN_HOSTS:=${KNOWN_HOSTS:="${HOME}/.ssh/known_hosts"}}
+HASH_KNOWN_HOSTS=${MONKEYSPHERE_HASH_KNOWN_HOSTS:=${HASH_KNOWN_HOSTS:="true"}}
+AUTHORIZED_KEYS=${MONKEYSPHERE_AUTHORIZED_KEYS:=${AUTHORIZED_KEYS:="${HOME}/.ssh/authorized_keys"}}
+
+# other variables not in config file
+AUTHORIZED_USER_IDS=${MONKEYSPHERE_AUTHORIZED_USER_IDS:="${MONKEYSPHERE_HOME}/authorized_user_ids"}
+REQUIRED_HOST_KEY_CAPABILITY=${MONKEYSPHERE_REQUIRED_HOST_KEY_CAPABILITY:="a"}
+REQUIRED_USER_KEY_CAPABILITY=${MONKEYSPHERE_REQUIRED_USER_KEY_CAPABILITY:="a"}
+
+# export GNUPGHOME and make sure gpg home exists with proper
+# permissions