.B update-known_hosts [HOST]...
Update the known_hosts file. For each specified host, gpg will be
queried for a key associated with the host URI (see HOST
-IDENTIFICATION in monkeysphere(5)), optionally querying a keyserver.
+IDENTIFICATION in
+.BR monkeysphere(7)),
+optionally querying a keyserver.
If an acceptable key is found for the host (see KEY ACCEPTABILITY in
-monkeysphere(5)), the key is added to the user's known_hosts file. If
-a key is found but is unacceptable for the host, any matching keys are
-removed from the user's known_hosts file. If no gpg key is found for
-the host, nothing is done. If no hosts are specified, all hosts
-listed in the known_hosts file will be processed. This subcommand
-will exit with a status of 0 if at least one acceptable key was found
-for a specified host, 1 if no matching keys were found at all, and 2
-if matching keys were found but none were acceptable. `k' may be used
-in place of `update-known_hosts'.
+.BR monkeysphere(7)),
+the key is added to the user's known_hosts file. If a key is found
+but is unacceptable for the host, any matching keys are removed from
+the user's known_hosts file. If no gpg key is found for the host,
+nothing is done. If no hosts are specified, all hosts listed in the
+known_hosts file will be processed. This subcommand will exit with a
+status of 0 if at least one acceptable key was found for a specified
+host, 1 if no matching keys were found at all, and 2 if matching keys
+were found but none were acceptable. `k' may be used in place of
+`update-known_hosts'.
+.TP
+.B ssh-proxycommand
+an ssh proxy command that can be used
+to trigger a monkeysphere update of the ssh known_hosts file for a
+host that is being connected to with ssh. This works by updating the
+known_hosts file for the host first, before an attempted connection to
+the host is made. Once the known_hosts file has been updated, a TCP
+connection to the host is made by exec'ing netcat(1). Regular ssh
+communication is then done over this netcat TCP connection (see
+ProxyCommand in ssh_config(5) for more info).
+
+This command is meant to be run as the ssh "ProxyCommand". This can
+either be done by specifying the proxy command on the command line:
+
+.B ssh -o ProxyCommand="monkeysphere ssh-proxycommand %h %p" ...
+
+or by adding the following line to your ~/.ssh/config script:
+
+.B ProxyCommand monkeysphere ssh-proxycommand %h %p
+
+The script can easily be incorporated into other ProxyCommand scripts
+by calling it with the "--no-connect" option, i.e.:
+
+.B monkeysphere ssh-proxycommand --no-connect "$HOST" "$PORT"
+
+This will run everything except the final exec of netcat to make the
+TCP connection to the host. In this way this command can be added to
+another proxy command that does other stuff, and then makes the
+connection to the host itself.
+
+KEYSERVER CHECKING:
+The proxy command has a fairly nuanced policy for when keyservers are
+queried when processing a host. If the host userID is not found in
+either the user's keyring or in the known_hosts file, then the
+keyserver is queried for the host userID. If the host userID is found
+in the user's keyring, then the keyserver is not checked. This
+assumes that the keyring is kept up-to-date, in a cronjob or the like,
+so that revocations are properly handled. If the host userID is not
+found in the user's keyring, but the host is listed in the known_hosts
+file, then the keyserver is not checked. This last policy might
+change in the future, possibly by adding a deferred check, so that
+hosts that go from non-monkeysphere-enabled to monkeysphere-enabled
+will be properly checked.
+
+Setting the MONKEYSPHERE_CHECK_KEYSERVER
+variable (to `true' or `false') will override the keyserver-checking policy
+defined above.
+
.TP
.B update-authorized_keys
Update the authorized_keys file for the user executing the command
each user ID in the user's authorized_user_ids file, gpg will be
queried for keys associated with that user ID, optionally querying a
keyserver. If an acceptable key is found (see KEY ACCEPTABILITY in
-monkeysphere(5)), the key is added to the user's authorized_keys file.
+.BR monkeysphere (7)),
+the key is added to the user's authorized_keys file.
If a key is found but is unacceptable for the user ID, any matching
keys are removed from the user's authorized_keys file. If no gpg key
is found for the user ID, nothing is done. This subcommand will exit
specified, but only one key exists in the secret keyring, that key
will be used. `g' may be used in place of `gen-subkey'.
.TP
+.B subkey-to-ssh-agent [ssh-add arguments]
+Push all authentication-capable subkeys in your GnuPG secret keyring
+into your running ssh-agent. Additional arguments are passed through
+to
+.BR ssh-add (1).
+For example, to remove the authentication subkeys, pass an additional
+`-d' argument. To require confirmation on each use of the key, pass
+`-c'. `s' may be used in place of `subkey-to-ssh-agent'.
+.TP
.B help
Output a brief usage summary. `h' or `?' may be used in place of
`help'.
The following environment variables will override those specified in
the monkeysphere.conf configuration file (defaults in parentheses):
.TP
+MONKEYSPHERE_LOG_LEVEL
+Set the log level (INFO). Can be SILENT, ERROR, INFO, VERBOSE, DEBUG,
+in increasing order of verbosity.
+.TP
MONKEYSPHERE_GNUPGHOME, GNUPGHOME
GnuPG home directory (~/.gnupg).
.TP
.SH FILES
.TP
-~/.config/monkeysphere/monkeysphere.conf
+~/.monkeysphere/monkeysphere.conf
User monkeysphere config file.
.TP
/etc/monkeysphere/monkeysphere.conf
System-wide monkeysphere config file.
.TP
-~/.config/monkeysphere/authorized_user_ids
+~/.monkeysphere/authorized_user_ids
OpenPGP user IDs associated with keys that will be checked for
addition to the authorized_keys file.
.SH SEE ALSO
-.BR monkeysphere-ssh-proxycommand (1),
-.BR monkeysphere-server (8),
-.BR monkeysphere (5),
+\" DELETEME
+\".BR monkeysphere-ssh-proxycommand (1),
+\".BR monkeysphere-server (8),
+.BR monkeysphere-host (8),
+.BR monkeysphere-authentication (8),
+.BR monkeysphere (7),
.BR ssh (1),
+.BR ssh-add (1),
.BR gpg (1)