X-Git-Url: https://codewiz.org/gitweb?a=blobdiff_plain;f=man%2Fman8%2Fmonkeysphere-server.8;h=0e699b93a90e53bd3017746d2500a352d1c71762;hb=5fadec09dcd44c4dcad657a0f3d96878b592b77b;hp=dbcc083f9bb7ec1c38883fd773f193a2174fa2ed;hpb=1b6df37b94b96042ac460a933b00c6ef29694053;p=monkeysphere.git diff --git a/man/man8/monkeysphere-server.8 b/man/man8/monkeysphere-server.8 index dbcc083..0e699b9 100644 --- a/man/man8/monkeysphere-server.8 +++ b/man/man8/monkeysphere-server.8 @@ -1,4 +1,4 @@ -.TH MONKEYSPHERE-SERVER "1" "June 2008" "monkeysphere 0.1" "User Commands" +.TH MONKEYSPHERE-SERVER "1" "June 2008" "monkeysphere" "User Commands" .SH NAME @@ -6,14 +6,14 @@ monkeysphere-server \- monkeysphere server admin user interface .SH SYNOPSIS -.B monkeysphere-server \fIcommand\fP [\fIargs\fP] +.B monkeysphere-server \fIsubcommand\fP [\fIargs\fP] .SH DESCRIPTION -\fBMonkeySphere\fP is a system to leverage the OpenPGP Web of Trust -for ssh authentication and encryption. OpenPGP keys are tracked via -GnuPG, and added to the ssh authorized_keys and known_hosts files to -be used for authentication of ssh connections. +\fBMonkeySphere\fP is a framework to leverage the OpenPGP Web of Trust +for ssh authentication. OpenPGP keys are tracked via GnuPG, and added +to the authorized_keys and known_hosts files used by ssh for +connection authentication. \fBmonkeysphere-server\fP is the MonkeySphere server admin utility. @@ -21,33 +21,52 @@ be used for authentication of ssh connections. \fBmonkeysphere-server\fP takes various subcommands: .TP -.B update-users [USER]... -Update the admin-controlled authorized_keys files for user. For each -user specified, user ID's listed in the user's authorized_user_ids -file are processed, and the user's authorized_keys file in -/var/cache/monkeysphere/authorized_keys/USER. See `man monkeysphere' -for more info. If the RAW_AUTHORIZED_KEYS variable is set, then a -user-controlled authorized_keys file (usually -~USER/.ssh/authorized_keys) is added to the authorized_keys file. `u' -may be used in place of `update-users. +.B update-users [ACCOUNT]... +Rebuild the monkeysphere-controlled authorized_keys files. For each +specified account, the user ID's listed in the account's +authorized_user_ids file are processed. For each user ID, gpg will be +queried for keys associated with that user ID, optionally querying a +keyserver. If an acceptable key is found (see KEY ACCEPTABILITY in +monkeysphere(5)), the key is added to the account's +monkeysphere-controlled authorized_keys file. If the +RAW_AUTHORIZED_KEYS variable is set, then a separate authorized_keys +file (usually ~USER/.ssh/authorized_keys) is appended to the +monkeysphere-controlled authorized_keys file. If no accounts are +specified, then all accounts on the system are processed. `u' may be +used in place of `update-users'. .TP -.B gen-key -Generate a gpg key for the host. `g' may be used in place of -`gen-key'. +.B gen-key [HOSTNAME] +Generate a OpenPGP key pair for the host. If HOSTNAME is not +specified, then the system fully-qualified domain name will be user. +An alternate key bit length can be specified with the `-l' or +`--length' option (default 2048). An expiration length can be +specified with the `-e' or `--expire' option (prompt otherwise). A +key revoker fingerprint can be specified with the `-r' or `--revoker' +option. `g' may be used in place of `gen-key'. .TP .B show-fingerprint Show the fingerprint for the host's OpenPGP key. `f' may be used in place of `show-fingerprint'. .TP .B publish-key -Publish the host's gpg key to the keyserver. `p' may be used in place -of `publish-key'. +Publish the host's OpenPGP key to the keyserver. `p' may be used in +place of `publish-key'. .TP -.B trust-key KEYID [LEVEL] -Set owner trust for key. If LEVEL is not specified, then the program -will prompt for an owner trust level to set for KEYID. This function -lsigns the key as well so that it will have a known validity. `t' may -be used in place of `trust-key'. +.B add-identity-certifier KEYID +Instruct system to trust user identity certifications made by KEYID. +A certifier domain can be specified with the `-n' or `--domain' +option. A certifier trust level can be specified with the `-t' or +`--trust' option (default is `full'). A certifier trust depth can be +specified with the `-d' or `--depth' option (default is 1). `a' may +be used in place of `add-identity-certifier'. +.TP +.B remove-identity-certifier KEYID +Instruct system to ignore user identity certifications made by KEYID. +`r' may be used in place of `remove-identity-certifier'. +.TP +.B list-identity-certifiers +List key IDs trusted by the system to certify user identities. `l' +may be used in place of `list-identity-certifiers'. .TP .B help Output a brief usage summary. `h' or `?' may be used in place of @@ -55,22 +74,84 @@ Output a brief usage summary. `h' or `?' may be used in place of .SH SETUP -In order to start using the monkeysphere, there are a couple of things -you need to do first. The first is to generate an OpenPGP key for the -server and convert that key to an ssh key that can be used by ssh for -host authentication. To do this, run the "gen-key" subcommand. Once -that is done, publish the key to a keyserver with "publish-key" -subcommand. Finally, you need to modify the sshd_config to tell sshd -where the new server host key: +In order to start using the monkeysphere, you must first generate an +OpenPGP key for the server and convert that key to an ssh key that can +be used by ssh for host authentication. This can be done with the +\fBgen-key\fP subcommand: + +$ monkeysphere-server gen-key + +To enable host verification via the monkeysphere, you must then +publish the host's key to the Web of Trust using the \fBpublish-key\fP +command to push the key to a keyserver. Then modify the sshd_config +to tell sshd where the new server host key is located: HostKey /var/lib/monkeysphere/ssh_host_rsa_key +In order for users logging into the system to be able to verify the +host via the monkeysphere, at least one person (ie. a server admin) +will need to sign the host's key. This is done in the same way that +key signing is usually done, by pulling the host's key from the +keyserver, signing the key, and re-publishing the signature. Once +that is done, users logging into the host will be able to certify the +host's key via the signature of the host admin. + If the server will also handle user authentication through -monkeysphere-generated authorized_keys files, set the following: +monkeysphere-generated authorized_keys files, the server must be told +which keys will act as user certifiers. This is done with the +\fBadd-certifier\fP command: + +$ monkeysphere-server add-certifier KEYID + +where KEYID is the key ID of the server admin, or whoever's signature +will be certifying users to the system. Certifiers can be later +remove with the \fBremove-certifier\fP command, and listed with the +\fBlist-certifiers\fP command. + +Remote user's will then be granted access to a local user account +based on the appropriately signed and valid keys associated with user +IDs listed in the authorized_user_ids file of the local user. By +default, the authorized_user_ids file for local users is found in +~/.config/monkeysphere/authorized_user_ids. This can be changed in +the monkeysphere-server.conf file. + +The \fBupdate-users\fP command can then be used to generate +authorized_keys file for local users based on the authorized user IDs +listed in the user's authorized_user_ids file: + +$ monkeysphere-server update-users USER + +sshd can then use these files to grant access to user accounts for +remote users. If no user is specified, authorized_keys files will be +generated for all users on the system. You must also tell sshd to +look at the monkeysphere-generated authorized_keys file for user +authentication by setting the following in the sshd_config: AuthorizedKeysFile /var/lib/monkeysphere/authorized_keys/%u -Once those changes are made, restart the ssh server. +It is recommended to add "monkeysphere-server update-users" to a +system crontab, so that user keys are kept up-to-date, and key +revokations and expirations can be processed in a timely manor. + +.SH ENVIRONMENT + +The following environment variables will override those specified in +the monkeysphere-server.conf configuration file (defaults in +parentheses): +.TP +MONKEYSPHERE_KEYSERVER +OpenPGP keyserver to use (subkeys.pgp.net). +.TP +MONKEYSPHERE_AUTHORIZED_USER_IDS +Path to user authorized_user_ids file +(%h/.config/monkeysphere/authorized_user_ids). +.TP +MONKEYSPHERE_RAW_AUTHORIZED_KEYS +Path to user-controlled authorized_keys file. `-' means not to add +user-controlled file (%h/.ssh/authorized_keys). +.TP +MONKEYSPHERE_MONKEYSPHERE_USER +User to control authentication keychain (monkeypshere). .SH FILES @@ -96,10 +177,12 @@ Monkeysphere authentication GNUPG home directory. .SH AUTHOR -Written by Jameson Rollins +Written by Jameson Rollins , Daniel Kahn +Gillmor .SH SEE ALSO .BR monkeysphere (1), +.BR monkeysphere (5), .BR gpg (1), .BR ssh (1)