+# add admin as identity certifier for testhost
+echo "### adding admin as certifier..."
+echo y | monkeysphere-server add-identity-certifier "$TEMPDIR"/admin/.gnupg/pubkey.gpg
+
+# initialize base sshd_config
+cp etc/ssh/sshd_config "$SSHD_CONFIG"
+# write the sshd_config
+cat <<EOF >> "$SSHD_CONFIG"
+HostKey ${MONKEYSPHERE_SYSDATADIR}/ssh_host_rsa_key
+AuthorizedKeysFile ${MONKEYSPHERE_SYSDATADIR}/authorized_keys/%u
+EOF
+
+# launch test sshd with the new host key.
+echo "### starting sshd..."
+socat EXEC:"/usr/sbin/sshd -f ${SSHD_CONFIG} -i -d -d -d -D -e" "UNIX-LISTEN:${SOCKET}" 2> "$TEMPDIR"/sshd.log &
+export SSHD_PID=$!
+
+
+### TESTUSER TESTS
+
+# generate an auth subkey for the test user
+echo "### generating key for testuser..."
+MONKEYSPHERE_GNUPGHOME="$TEMPDIR"/testuser/.gnupg \
+SSH_ASKPASS=echo \
+ monkeysphere gen-subkey --expire 0
+
+# add server key to testuser keychain
+echo "### export server key to testuser..."
+gpgadmin --armor --export "$HOSTKEYID" | \
+ GNUPGHOME="$TEMPDIR"/testuser/.gnupg gpg --import
+
+# connect to test sshd, using monkeysphere-ssh-proxycommand to verify
+# the identity before connection. This should work in both directions!
+echo "### testuser connecting to sshd socket..."
+PROXY_COMMAND="monkeysphere-ssh-proxycommand --no-connect %h && socat STDIO UNIX:${SOCKET}"
+GNUPGHOME="$TEMPDIR"/testuser/.gnupg \
+MONKEYSPHERE_HOME="$TEMPDIR"/testuser/.monkeysphere \
+ ssh -F "$TEMPDIR"/testuser/.ssh/config -v -v -v -oProxyCommand="$PROXY_COMMAND" testhost