# version 3 or later.
setup() {
- # make the core and the sphere:
- mkdir -p "${SYSDATADIR}"/authentication
- mkdir -p "${GNUPGHOME_SPHERE}"
+ # make all needed directories
+ mkdir -p "${MADATADIR}"
+ mkdir -p "${MATMPDIR}"
mkdir -p "${GNUPGHOME_CORE}"
+ chmod 700 "${GNUPGHOME_CORE}"
+ mkdir -p "${GNUPGHOME_SPHERE}"
+ chmod 700 "${GNUPGHOME_SPHERE}"
+ mkdir -p "${MADATADIR}"/authorized_keys
# deliberately replace the config files via truncation
# FIXME: should we be dumping to tmp files and then moving atomically?
# Edits will be overwritten.
no-greeting
primary-keyring ${GNUPGHOME_SPHERE}/pubring.gpg
-keyring ${GNUPGHOME_CORE}/pubring.gpg
-
list-options show-uid-validity
EOF
- # fingerprint of core key. this should be empty on unconfigured systems.
+ # make sure the monkeysphere user owns everything in th sphere
+ # gnupghome
+ chown -R "$MONKEYPSHER_USER" "${GNUPGHOME_SPHERE}"
+ chgrp -R "$MONKEYPSHER_USER" "${GNUPGHOME_SPHERE}"
+
+ # get fingerprint of core key. this should be empty on unconfigured systems.
local CORE_FPR=$(gpg_core --with-colons --fixed-list-mode --fingerprint --list-secret-key | grep ^fpr: | cut -f10 -d: )
if [ -z "$CORE_FPR" ] ; then
local CORE_UID=$(printf "Monkeysphere authentication trust core UID (random string: %s)" $(head -c21 </dev/urandom | base64))
- local TMPLOC=$(mktemp -d ${MATMPDIR}/tmp.XXXXXXXXXX) || failure "Could not create temporary directory!"
- ssh-keygen -q -b 2048 -t rsa -N'' "${TMPLOC}/authkey" || failure "Could not generate new key for Monkeysphere authentication trust core"
+ local TMPLOC=$(mktemp -d "${MATMPDIR}"/tmp.XXXXXXXXXX) || failure "Could not create temporary directory!"
+ # generate the key with ssh-keygen...
+ ssh-keygen -q -b 1024 -t rsa -N '' -f "${TMPLOC}/authkey" || failure "Could not generate new key for Monkeysphere authentication trust core"
+ # and then translate to openpgp encoding and import
# FIXME: pem2openpgp currently sets the A flag and a short
# expiration date. We should set the C flag and no expiration
# date.
- < "${TMPLOC}/authkey" pem2openpgp "$CORE_UID" | gpg --import || failure "Could not import new key for Monkeysphere authentication trust core"
+ < "${TMPLOC}/authkey" pem2openpgp "$CORE_UID" | gpg_core --import || failure "Could not import new key for Monkeysphere authentication trust core"
+ # get fingerprint of core key. should definitely not be empty at this point
CORE_FPR=$(gpg_core --with-colons --fixed-list-mode --fingerprint --list-secret-key | grep ^fpr: | cut -f10 -d: )
if [ -z "$CORE_FPR" ] ; then
failure "Failed to create Monkeysphere authentication trust core!"