-[[meta title="Advanced usage of the Monkeysphere"]]
+[[!meta title="Advanced usage of the Monkeysphere"]]
Advanced usage of the monkeysphere
==================================
-[[meta title="Monkeysphere archive signing key"]]
+[[!meta title="Monkeysphere archive signing key"]]
[[toc ]]
## Verifying the key ##
-[[meta title="Open Bugs"]]
+[[!meta title="Open Bugs"]]
# Bugs #
Please feel free to also ask any questions on the [the monkeysphere
mailing list](/community).
-[[inline pages="./bugs/* and !./bugs/done and !link(done)
+[[!inline pages="./bugs/* and !./bugs/done and !link(done)
and !*/Discussion" actions=yes postform=yes show=0]]
-[[meta title="Add man pages to web site"]]
+[[!meta title="Add man pages to web site"]]
We should publish the various monkeysphere man pages in browsable form
somewhere under http://web.monkeysphere.info/. Ideally, this would be
-[[meta title="monkeysphere-server publish-key does not work"]]
+[[!meta title="monkeysphere-server publish-key does not work"]]
Currently, if you try to run `monkeysphere-server publish-key`, you
can get the following output:
-[[meta title="Monkeysphere support for options in authorized_keys"]]
+[[!meta title="Monkeysphere support for options in authorized_keys"]]
OpenSSH [allows users to control the capabilities granted to remote
key-based
-[[meta title="users with missing or empty authorized keys and User IDs should have MS-generated keys cleared" ]]
+[[!meta title="users with missing or empty authorized keys and User IDs should have MS-generated keys cleared" ]]
I had a user who had a bunch of entries in
`~/.monkeysphere/authorized_user_ids`, and a bunch of raw keys in
-[[meta title="Monkeysphere interferes with clusterssh"]]
+[[!meta title="Monkeysphere interferes with clusterssh"]]
clusterssh is a package that allows you to control multiple ssh xterm
sessions at the same time.
-[[meta title="Completed Bugs"]]
+[[!meta title="Completed Bugs"]]
Recently fixed [[bugs]].
-[[inline pages="./* and link(./done) and !*/Discussion" sort=mtime show=10]]
+[[!inline pages="./* and link(./done) and !*/Discussion" sort=mtime show=10]]
-[[meta title="genericize all filesystem locations to enable test suite:" ]]
+[[!meta title="genericize all filesystem locations to enable test suite:" ]]
I'm in the process of writing a testsuite for the monkeysphere so that
we can verify that it actually performs all the basic expected duties
-[[meta title="MonkeySphere can't deal with passphrase-locked primary keys"]]
+[[!meta title="MonkeySphere can't deal with passphrase-locked primary keys"]]
At the moment, the only tool we have to export passphrase-locked
secret keys from the GPG keyring is `gpg` itself (and `gpg2`, which
-[[meta title="Running `monkeysphere gen-key` on a headless server takes way too long"]]
+[[!meta title="Running `monkeysphere gen-key` on a headless server takes way too long"]]
When i try to generate a key on a headless machine (no kbd, no mouse,
no Human Input Device (HID) at all), `monkeysphere gen-key` hangs for
-[[meta title="Install seckey2sshagent in /usr/bin/"]]
+[[!meta title="Install seckey2sshagent in /usr/bin/"]]
I know it's a hack - but installing seckey2sshagent in /usr/bin/ would make it
much easier for people to use.
-[[meta title="list-identity-certfiers should run as the non-privileged user"]]
+[[!meta title="list-identity-certfiers should run as the non-privileged user"]]
Right now, `monkeysphere-server list-identity-certifiers` runs as the
superuser, and just lists the keys in the host's keyring. This might
-[[meta title="make tarball is not idempotent" ]]
+[[!meta title="make tarball is not idempotent" ]]
The current monkeysphere Makefile has a "tarball" target, which
produces the "upstream tarball". Unfortunately, it is not idempotent.
-[[meta title="Missing `~/.ssh/known_hosts` file causes errors from monkeysphere-ssh-proxycommand"]]
+[[!meta title="Missing `~/.ssh/known_hosts` file causes errors from monkeysphere-ssh-proxycommand"]]
As a user, if you don't have a `~/.ssh/known_hosts` file,
`monkeysphere-ssh-proxycommand` produces some bogus output, like:
-[[meta title="`monkeysphere gen-key` should guess at KeyID if none provided"]]
+[[!meta title="`monkeysphere gen-key` should guess at KeyID if none provided"]]
Currently, if you have a single private key in your GnuPG keyring, and
you call:
-[[meta title="monkeysphere --gen-subkey seems to fail if no gpg-agent is running"]]
+[[!meta title="monkeysphere --gen-subkey seems to fail if no gpg-agent is running"]]
Consider the following transcript of a user who starts with no OpenPGP
key in the first place:
-[[meta title="Monkeysphere should consult keyserver setting in gpg.conf"]]
+[[!meta title="Monkeysphere should consult keyserver setting in gpg.conf"]]
Currently, monkeysphere-ssh-proxycommand checks the following places to
determine which keyserver to use (in order of priority):
-[[meta title="Support multiple host names for monkeysphere-enabled servers"]]
+[[!meta title="Support multiple host names for monkeysphere-enabled servers"]]
Some monkeysphere-enabled hosts answer to multiple host names, but the
current `monkeysphere-server` only generates a single User ID
-[[meta title="debian packaging postinst script clobbers gpg.conf settings in /var/lib/monkeysphere" ]]
+[[!meta title="debian packaging postinst script clobbers gpg.conf settings in /var/lib/monkeysphere" ]]
Do we want to allow the system administrator to make adjustments to
the `gpg.conf` config files found in `/var/lib/monkeysphere`? At the
-[[meta title="Problems with root-owned gpg keyrings"]]
+[[!meta title="Problems with root-owned gpg keyrings"]]
`/var/lib/monkeysphere/gnupg-host/` is root-owned, and the public
keyring in that directory is controlled by the superuser.
-[[meta title="Reorganize monkeysphere-server shortcuts"]]
+[[!meta title="Reorganize monkeysphere-server shortcuts"]]
Currently, `monkeysphere-server` supports three subcommands to adjust
the "identity certifiers":
-[[meta title="revoke-hostname function revokes wrong hostname user ID"]]
+[[!meta title="revoke-hostname function revokes wrong hostname user ID"]]
It appears that the monkeysphere-server revoke-hostname function will
occasionaly revoke the wrong hostname. I say occasionally, but it
-[[meta title="proposed new monkeysphere-server subcommand: setup" ]]
+[[!meta title="proposed new monkeysphere-server subcommand: setup" ]]
What if everything that's done in the package post-installation
scripts (aside from maybe the creation of the monkeysphere user
-[[meta title="Setup test public server/gpg key"]]
+[[!meta title="Setup test public server/gpg key"]]
It would be really useful for people trying out the monkeysphere to be able to
test it with a participating server as soon as they've finished setting things
-[[meta title="The Monkeysphere Community"]]
+[[!meta title="The Monkeysphere Community"]]
# The Monkeysphere Community #
-[[meta title="Documentation"]]
+[[!meta title="Documentation"]]
# Documentation #
-[[meta title="Download"]]
+[[!meta title="Download"]]
# Downloading and Installing #
-[[meta title="Expanding the Monkeysphere"]]
+[[!meta title="Expanding the Monkeysphere"]]
# Expanding the Monkeysphere #
-[[meta title="Features"]]
+[[!meta title="Features"]]
# Features #
-[[meta title="The Monkeysphere Project"]]
-[[meta license="Unless otherwise noted, all content on this web site is licensed under the GPL version 3 or later"]]
-[[meta copyright="All content on this web site is copyright by the author of that content. [Look in the revision control system](community) for details about who authored a particular piece of content."]]
+[[!meta title="The Monkeysphere Project"]]
+[[!meta license="Unless otherwise noted, all content on this web site is licensed under the GPL version 3 or later"]]
+[[!meta copyright="All content on this web site is copyright by the author of that content. [Look in the revision control system](community) for details about who authored a particular piece of content."]]
# The Monkeysphere Project #
-[[meta title="Mirroring the Monkeysphere web site"]]
+[[!meta title="Mirroring the Monkeysphere web site"]]
# Mirroring the Monkeysphere web site #
-[[meta title="News"]]
+[[!meta title="News"]]
# News #
Here are the latest announcements about the Monkeysphere.
-[[inline pages="./news/* and !*/Discussion" rootpage="news" show="30"]]
+[[!inline pages="./news/* and !*/Discussion" rootpage="news" show="30"]]
-[[meta title="Monkeysphere 0.24 accepted in Debian testing"]]
+[[!meta title="Monkeysphere 0.24 accepted in Debian testing"]]
[Monkeysphere 0.24 is now available in the Debian testing distribution
("squeeze")](http://packages.debian.org/testing/monkeysphere).
-[[meta title="Monkeysphere 0.24 accepted as a Debian Backport"]]
+[[!meta title="Monkeysphere 0.24 accepted as a Debian Backport"]]
[Monkeysphere 0.24 is now available at [Backports.org](http://backports.org).
If you are running Debian stable ("Lenny"), you can install this version
-[[meta title="FreeBSD 0.24 port accepted"]]
+[[!meta title="FreeBSD 0.24 port accepted"]]
FreeBSD's ports tree now contains [a port of the
Monkeysphere](http://www.freebsd.org/cgi/ports.cgi?query=monkeysphere),
-[[meta title="FreeBSD port available"]]
+[[!meta title="FreeBSD port available"]]
Update: [FreeBSD's official ports tree now contains monkeysphere
0.24](FreeBSD-0.24-port-accepted).
-[[meta title="Monkeysphere now in Debian!"]]
+[[!meta title="Monkeysphere now in Debian!"]]
[The Monkeysphere has made it into
Debian!](http://packages.debian.org/sid/monkeysphere)
-[[meta title="APT repository moved"]]
+[[!meta title="APT repository moved"]]
The monkeysphere APT repository has been moved from
`http://monkeysphere.info/debian` to
-[[meta title="git repository moved"]]
+[[!meta title="git repository moved"]]
The monkeysphere git repository has been moved from
`git://monkeysphere.info/monkeysphere` to
-[[meta title="GnuTLS 2.6.x enables Monkeysphere to read authentication subkeys"]]
+[[!meta title="GnuTLS 2.6.x enables Monkeysphere to read authentication subkeys"]]
-----
-[[meta title="Modified GnuTLS 2.4.x available"]]
+[[!meta title="Modified GnuTLS 2.4.x available"]]
-----
-[[meta title="Plans for The Golden Bezoar"]]
+[[!meta title="Plans for The Golden Bezoar"]]
A workday with several Monkeysphere contributors on 2009-01-31
resulted in a significant reorganization of the project in several
-[[meta title="MonkeySphere 0.10-1 released!"]]
+[[!meta title="MonkeySphere 0.10-1 released!"]]
# MonkeySphere 0.10-1 released! #
-[[meta title="MonkeySphere 0.11-1 released!"]]
+[[!meta title="MonkeySphere 0.11-1 released!"]]
# MonkeySphere 0.11-1 released! #
-[[meta title="MonkeySphere 0.12-1 released!"]]
+[[!meta title="MonkeySphere 0.12-1 released!"]]
# MonkeySphere 0.12-1 released! #
-[[meta title="MonkeySphere 0.13-1 released!"]]
+[[!meta title="MonkeySphere 0.13-1 released!"]]
# MonkeySphere 0.13-1 released! #
-[[meta title="MonkeySphere 0.14-1 released!"]]
+[[!meta title="MonkeySphere 0.14-1 released!"]]
# MonkeySphere 0.14-1 released! #
-[[meta title="MonkeySphere 0.15-1 released!"]]
+[[!meta title="MonkeySphere 0.15-1 released!"]]
# MonkeySphere 0.15-1 released! #
-[[meta title="Monkeysphere 0.16-1 released!"]]
+[[!meta title="Monkeysphere 0.16-1 released!"]]
# Monkeysphere 0.16-1 released! #
-[[meta title="Monkeysphere 0.17-1 released!"]]
+[[!meta title="Monkeysphere 0.17-1 released!"]]
# Monkeysphere 0.17-1 released! #
-[[meta title="Monkeysphere 0.18-1 released!"]]
+[[!meta title="Monkeysphere 0.18-1 released!"]]
# Monkeysphere 0.18-1 released! #
-[[meta title="Monkeysphere 0.19-1 released!"]]
+[[!meta title="Monkeysphere 0.19-1 released!"]]
# Monkeysphere 0.19-1 released! #
-[[meta title="Monkeysphere 0.20-1 released!"]]
+[[!meta title="Monkeysphere 0.20-1 released!"]]
Monkeysphere 0.20-1 has been released.
-[[meta title="Monkeysphere 0.21-1 released!"]]
+[[!meta title="Monkeysphere 0.21-1 released!"]]
Monkeysphere 0.21-1 has been released.
-[[meta title="Monkeysphere 0.22-1 released!"]]
+[[!meta title="Monkeysphere 0.22-1 released!"]]
Monkeysphere 0.22-1 has been released.
-[[meta title="Monkeysphere 0.23-1 released!"]]
+[[!meta title="Monkeysphere 0.23-1 released!"]]
Monkeysphere 0.23-1 has been released.
-[[meta title="Monkeysphere 0.23.1-1 released!"]]
+[[!meta title="Monkeysphere 0.23.1-1 released!"]]
Monkeysphere 0.23.1-1 has been released.
-[[meta title="Monkeysphere 0.24-1 released!"]]
+[[!meta title="Monkeysphere 0.24-1 released!"]]
Monkeysphere 0.24-1 has been released.
-[[meta title="Monkeysphere 0.25-1 released!"]]
+[[!meta title="Monkeysphere 0.25-1 released!"]]
Monkeysphere 0.25-1 has been released.
-[[meta title="Monkeysphere 0.26-1 released!"]]
+[[!meta title="Monkeysphere 0.26-1 released!"]]
Monkeysphere 0.26-1 has been released.
-[[meta title="Monkeysphere 0.27-1 released!"]]
+[[!meta title="Monkeysphere 0.27-1 released!"]]
Monkeysphere 0.27-1 has been released.
-[[meta title="Monkeysphere 0.28 released!"]]
+[[!meta title="Monkeysphere 0.28 released!"]]
Monkeysphere 0.28 has been released.
-[[meta title="MonkeySphere 0.8-1 released!"]]
+[[!meta title="MonkeySphere 0.8-1 released!"]]
MonkeySphere 0.8-1 has been released. This release contains bugfixes,
some UI re-arrangement, and new features for `monkeysphere-server`,
-[[meta title="MonkeySphere 0.9-1 released!"]]
+[[!meta title="MonkeySphere 0.9-1 released!"]]
# MonkeySphere 0.9-1 released! #
-[[meta title="Screenshots"]]
+[[!meta title="Screenshots"]]
# Screenshots #
-[[meta title="Similar Projects"]]
+[[!meta title="Similar Projects"]]
The monkeysphere isn't the only project intending to implement a PKI
for OpenSSH. We provide links to these other projects because they're
-[[meta title="Technical Details"]]
+[[!meta title="Technical Details"]]
# Technical Details #
-[[meta title="OpenPGP Trust Models"]]
+[[!meta title="OpenPGP Trust Models"]]
# OpenPGP Trust Models #
If you trust my judgement in this area ([the
spec](http://tools.ietf.org/html/rfc4880#section-5.2.3.13) calls my
-role in this scenario a "meta introducer"), then you should be able to
+role in this scenario a "!meta introducer"), then you should be able to
automatically accept certifications made by my sister by creating a
level 2 trust signature on my key. You can choose whether to publish
this trust signature or not, but as long as your `gpg` instance knows
-[[meta title="Our vision for the future of the monkeysphere"]]
+[[!meta title="Our vision for the future of the monkeysphere"]]
## External Validation Agent ##
-[[meta title="Why should you be interested in the Monkeysphere?"]]
+[[!meta title="Why should you be interested in the Monkeysphere?"]]
# Why should you be interested in the Monkeysphere? #