From: Matt Goins <mjgoins@openflows.com>
Date: Sun, 1 Feb 2009 01:34:34 +0000 (-0500)
Subject: Merge commit 'jrollins/master'
X-Git-Tag: monkeysphere_0.23~156
X-Git-Url: https://codewiz.org/gitweb?a=commitdiff_plain;h=478cc34eee374166aae51f8598aa392e1fbfdde6;hp=334f15b617fd89162336697e73c7f5645f0d1d3d;p=monkeysphere.git

Merge commit 'jrollins/master'
---

diff --git a/etc/authentication/config b/etc/authentication/config
deleted file mode 100644
index c9b57d2..0000000
--- a/etc/authentication/config
+++ /dev/null
@@ -1,28 +0,0 @@
-# Monkeysphere authentication configuration file.
-
-# This is an sh-style shell configuration file.  Variable names should
-# be separated from their assignments by a single '=' and no spaces.
-# Environment variables with the same names as these variables but
-# prefaced by "MONKEYSPHERE_" will take precedence over the values
-# specified here.
-
-# Log level.  Can be SILENT, ERROR, INFO, VERBOSE, DEBUG, in
-# increasing order of verbosity.
-#LOG_LEVEL=INFO
-
-# User who controls the monkeysphere 'sphere' keyring.
-#MONKEYSPHERE_USER=monkeysphere
-
-# Path to authorized_user_ids file to process to create
-# authorized_keys file.  '%h' will be replaced by the home directory
-# of the user, and '%u' will be replaced by the username of the user.
-# For purely admin-controlled authorized_user_ids, you might put them
-# in /etc/monkeysphere/authorized_user_ids/%u, for instance.
-#AUTHORIZED_USER_IDS="%h/.monkeysphere/authorized_user_ids"
-
-# Path to a user controlled authorized_keys file to be added to the
-# monkeysphere-generated authorized_keys file.  '%h' will be replaced
-# by the home directory of the user, and '%u' will by replaced by the
-# username of the user.  Setting this variable to 'none' prevents the
-# inclusion of user controlled authorized_keys file.
-# RAW_AUTHORIZED_KEYS="%h/.ssh/authorized_keys"
diff --git a/etc/authentication/gpg.conf b/etc/authentication/gpg.conf
deleted file mode 100644
index 77b96e1..0000000
--- a/etc/authentication/gpg.conf
+++ /dev/null
@@ -1,15 +0,0 @@
-# Monkeysphere authentication GNUPG home gpg.conf
-
-# Location of the various Monkeysphere keyrings.
-# It is highly recommended that you
-#    DO NOT MODIFY
-# these variables.
-primary-keyring /var/lib/monkeysphere/authentication/sphere/pubring.gpg
-keyring /var/lib/monkeysphere/authentication/core/pubring.gpg
-
-# PGP keyserver to use for PGP queries.
-keyserver hkp://pool.sks-keyservers.net
-
-# GPG list options.  It is recommended that you have at least
-# "show-uid-validity".
-list-options show-uid-validity
diff --git a/etc/host/config b/etc/host/config
deleted file mode 100644
index 293cbe0..0000000
--- a/etc/host/config
+++ /dev/null
@@ -1,11 +0,0 @@
-# Monkeysphere host configuration file.
-
-# This is an sh-style shell configuration file.  Variable names should
-# be separated from their assignments by a single '=' and no spaces.
-# Environment variables with the same names as these variables but
-# prefaced by "MONKEYSPHERE_" will take precedence over the values
-# specified here.
-
-# Log level.  Can be SILENT, ERROR, INFO, VERBOSE, DEBUG, in
-# increasing order of verbosity.
-#LOG_LEVEL=INFO
diff --git a/etc/host/gpg.conf b/etc/host/gpg.conf
deleted file mode 100644
index 66c668b..0000000
--- a/etc/host/gpg.conf
+++ /dev/null
@@ -1,5 +0,0 @@
-# Monkeysphere host GNUPG home gpg.conf
-
-# GPG list options.  It is recommended that you have at least
-# "show-uid-validity".
-list-options show-uid-validity
diff --git a/etc/monkeysphere-authentication.conf b/etc/monkeysphere-authentication.conf
new file mode 100644
index 0000000..ea40966
--- /dev/null
+++ b/etc/monkeysphere-authentication.conf
@@ -0,0 +1,31 @@
+# Monkeysphere authentication configuration file.
+
+# This is an sh-style shell configuration file.  Variable names should
+# be separated from their assignments by a single '=' and no spaces.
+# Environment variables with the same names as these variables but
+# prefaced by "MONKEYSPHERE_" will take precedence over the values
+# specified here.
+
+# Log level.  Can be SILENT, ERROR, INFO, VERBOSE, DEBUG, in
+# increasing order of verbosity.
+#LOG_LEVEL=INFO
+
+# OpenPGP keyserver
+#KEYSERVER=pool.sks-keyservers.net
+
+# User who controls the monkeysphere 'sphere' keyring.
+#MONKEYSPHERE_USER=monkeysphere
+
+# Path to authorized_user_ids file to process to create
+# authorized_keys file.  '%h' will be replaced by the home directory
+# of the user, and '%u' will be replaced by the username of the user.
+# For purely admin-controlled authorized_user_ids, you might put them
+# in /etc/monkeysphere/authorized_user_ids/%u, for instance.
+#AUTHORIZED_USER_IDS="%h/.monkeysphere/authorized_user_ids"
+
+# Path to a user controlled authorized_keys file to be added to the
+# monkeysphere-generated authorized_keys file.  '%h' will be replaced
+# by the home directory of the user, and '%u' will by replaced by the
+# username of the user.  Setting this variable to 'none' prevents the
+# inclusion of user controlled authorized_keys file.
+# RAW_AUTHORIZED_KEYS="%h/.ssh/authorized_keys"
diff --git a/etc/monkeysphere-host.conf b/etc/monkeysphere-host.conf
new file mode 100644
index 0000000..80a4b65
--- /dev/null
+++ b/etc/monkeysphere-host.conf
@@ -0,0 +1,14 @@
+# Monkeysphere host configuration file.
+
+# This is an sh-style shell configuration file.  Variable names should
+# be separated from their assignments by a single '=' and no spaces.
+# Environment variables with the same names as these variables but
+# prefaced by "MONKEYSPHERE_" will take precedence over the values
+# specified here.
+
+# Log level.  Can be SILENT, ERROR, INFO, VERBOSE, DEBUG, in
+# increasing order of verbosity.
+#LOG_LEVEL=INFO
+
+# OpenPGP keyserver
+#KEYSERVER=pool.sks-keyservers.net
diff --git a/src/common b/src/common
index 5df8f6a..ef931ca 100644
--- a/src/common
+++ b/src/common
@@ -4,7 +4,7 @@
 # Shared sh functions for the monkeysphere
 #
 # Written by
-# Jameson Rollins <jrollins@fifthhorseman.net>
+# Jameson Rollins <jrollins@finestructure.net>
 # Jamie McClelland <jm@mayfirst.org>
 # Daniel Kahn Gillmor <dkg@fifthhorseman.net>
 #
diff --git a/src/monkeysphere b/src/monkeysphere
index 342d59a..46abf6f 100755
--- a/src/monkeysphere
+++ b/src/monkeysphere
@@ -6,8 +6,9 @@
 # Jameson Rollins <jrollins@fifthhorseman.net>
 # Jamie McClelland <jm@mayfirst.org>
 # Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+# Micah Anderson <micah@riseup.net>
 #
-# They are Copyright 2008, and are all released under the GPL, version 3
+# They are Copyright 2008-2009, and are all released under the GPL, version 3
 # or later.
 
 ########################################################################
diff --git a/src/monkeysphere-authentication b/src/monkeysphere-authentication
index 1763b03..56a8877 100755
--- a/src/monkeysphere-authentication
+++ b/src/monkeysphere-authentication
@@ -3,26 +3,31 @@
 # monkeysphere-authentication: Monkeysphere authentication admin tool
 #
 # The monkeysphere scripts are written by:
-# Jameson Rollins <jrollins@fifthhorseman.net>
+# Jameson Rollins <jrollins@finestructure.net>
 # Jamie McClelland <jm@mayfirst.org>
 # Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+# Micah Anderson <micah@riseup.net>
 #
-# They are Copyright 2008, and are all released under the GPL, version 3
-# or later.
+# They are Copyright 2008-2009, and are all released under the GPL,
+# version 3 or later.
 
 ########################################################################
+set -e
+
 PGRM=$(basename $0)
 
 SYSSHAREDIR=${MONKEYSPHERE_SYSSHAREDIR:-"/usr/share/monkeysphere"}
 export SYSSHAREDIR
 . "${SYSSHAREDIR}/common" || exit 1
 
-SYSDATADIR=${MONKEYSPHERE_SYSDATADIR:-"/var/lib/monkeysphere/authentication"}
+# sharedir for authentication functions
+MASHAREDIR="${SYSSHAREDIR}/ma"
+
+SYSDATADIR=${MONKEYSPHERE_SYSDATADIR:-"/var/lib/monkeysphere"}
 export SYSDATADIR
 
-# monkeysphere temp directory, in sysdatadir to enable atomic moves of
-# authorized_keys files
-MSTMPDIR="${SYSDATADIR}/tmp"
+# temp directory to enable atomic moves of authorized_keys files
+MATMPDIR="${SYSDATADIR}/tmp"
 export MSTMPDIR
 
 # UTC date in ISO 8601 format if needed
@@ -75,11 +80,11 @@ su_monkeysphere_user() {
     fi
 }
 
-# function to interact with the host gnupg keyring
-gpg_host() {
+# function to interact with the gpg core keyring
+gpg_core() {
     local returnCode
 
-    GNUPGHOME="$GNUPGHOME_HOST"
+    GNUPGHOME="$GNUPGHOME_CORE"
     export GNUPGHOME
 
     # NOTE: we supress this warning because we need the monkeysphere
@@ -91,49 +96,23 @@ gpg_host() {
 
     # always reset the permissions on the host pubring so that the
     # monkeysphere user can read the trust signatures
-    chgrp "$MONKEYSPHERE_USER" "${GNUPGHOME_HOST}/pubring.gpg"
-    chmod g+r "${GNUPGHOME_HOST}/pubring.gpg"
+    chgrp "$MONKEYSPHERE_USER" "${GNUPGHOME_CORE}/pubring.gpg"
+    chmod g+r "${GNUPGHOME_CORE}/pubring.gpg"
     
     return "$returnCode"
 }
 
-# function to interact with the authentication gnupg keyring
+# function to interact with the gpg sphere keyring
 # FIXME: this function requires basically accepts only a single
 # argument because of problems with quote expansion.  this needs to be
 # fixed/improved.
-gpg_authentication() {
-    GNUPGHOME="$GNUPGHOME_AUTHENTICATION"
+gpg_sphere() {
+    GNUPGHOME="$GNUPGHOME_SPHERE"
     export GNUPGHOME
 
     su_monkeysphere_user "gpg $@"
 }
 
-# check if user is root
-is_root() {
-    [ $(id -u 2>/dev/null) = '0' ]
-}
-
-# check that user is root, for functions that require root access
-check_user() {
-    is_root || failure "You must be root to run this command."
-}
-
-# output just key fingerprint
-fingerprint_server_key() {
-    # set the pipefail option so functions fails if can't read sec key
-    set -o pipefail
-
-    gpg_host --list-secret-keys --fingerprint \
-	--with-colons --fixed-list-mode 2> /dev/null | \
-	grep '^fpr:' | head -1 | cut -d: -f10 2>/dev/null
-}
-
-# function to check for host secret key
-check_host_keyring() {
-    fingerprint_server_key >/dev/null \
-	|| failure "You don't appear to have a Monkeysphere host key on this server.  Please run 'monkeysphere-server gen-key' first."
-}
-
 ########################################################################
 # MAIN
 ########################################################################
@@ -145,7 +124,7 @@ unset RAW_AUTHORIZED_KEYS
 unset MONKEYSPHERE_USER
 
 # load configuration file
-[ -e ${MONKEYSPHERE_SERVER_CONFIG:="${SYSCONFIGDIR}/monkeysphere-server.conf"} ] && . "$MONKEYSPHERE_SERVER_CONFIG"
+[ -e ${MONKEYSPHERE_AUTHENTICATION_CONFIG:="${SYSCONFIGDIR}/monkeysphere-authentication.conf"} ] && . "$MONKEYSPHERE_AUTHENTICATION_CONFIG"
 
 # set empty config variable with ones from the environment, or with
 # defaults
@@ -158,19 +137,19 @@ MONKEYSPHERE_USER=${MONKEYSPHERE_MONKEYSPHERE_USER:=${MONKEYSPHERE_USER:="monkey
 # other variables
 CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:="true"}
 REQUIRED_USER_KEY_CAPABILITY=${MONKEYSPHERE_REQUIRED_USER_KEY_CAPABILITY:="a"}
-GNUPGHOME_HOST=${MONKEYSPHERE_GNUPGHOME_HOST:="${SYSDATADIR}/gnupg-host"}
-GNUPGHOME_AUTHENTICATION=${MONKEYSPHERE_GNUPGHOME_AUTHENTICATION:="${SYSDATADIR}/gnupg-authentication"}
+GNUPGHOME_CORE=${MONKEYSPHERE_GNUPGHOME_CORE:="${SYSDATADIR}/authentication/core"}
+GNUPGHOME_SPHERE=${MONKEYSPHERE_GNUPGHOME_SPHERE:="${SYSDATADIR}/authentication/sphere"}
 
 # export variables needed in su invocation
 export DATE
 export MODE
-export MONKEYSPHERE_USER
 export LOG_LEVEL
+export MONKEYSPHERE_USER
 export KEYSERVER
 export CHECK_KEYSERVER
 export REQUIRED_USER_KEY_CAPABILITY
-export GNUPGHOME_HOST
-export GNUPGHOME_AUTHENTICATION
+export GNUPGHOME_CORE
+export GNUPGHOME_SPHERE
 export GNUPGHOME
 
 # get subcommand
@@ -180,40 +159,36 @@ shift
 
 case $COMMAND in
     'update-users'|'update-user'|'u')
-	check_user
-	check_host_keyring
+	source "${MASHAREDIR}/update_users"
 	update_users "$@"
 	;;
 
     'add-identity-certifier'|'add-id-certifier'|'add-certifier'|'c+')
-	check_user
-	check_host_keyring
+	source "${MASHAREDIR}/add_certifier"
 	add_certifier "$@"
 	;;
 
     'remove-identity-certifier'|'remove-id-certifier'|'remove-certifier'|'c-')
-	check_user
-	check_host_keyring
+	source "${MASHAREDIR}/remove_certifier"
 	remove_certifier "$@"
 	;;
 
     'list-identity-certifiers'|'list-id-certifiers'|'list-certifiers'|'list-certifier'|'c')
-	check_user
-	check_host_keyring
+	source "${MASHAREDIR}/list_certifiers"
 	list_certifiers "$@"
 	;;
 
     'expert'|'e')
-	check_user
 	SUBCOMMAND="$1"
 	shift
 	case "$SUBCOMMAND" in
 	    'diagnostics'|'d')
+		source "${MASHAREDIR}/diagnostics"
 		diagnostics
 		;;
 
 	    'gpg-cmd')
-		gpg_authentication "$@"
+		gpg_sphere "$@"
 		;;
 
 	    *)
diff --git a/src/monkeysphere-host b/src/monkeysphere-host
index 1f68256..32e2293 100755
--- a/src/monkeysphere-host
+++ b/src/monkeysphere-host
@@ -17,7 +17,10 @@ SYSSHAREDIR=${MONKEYSPHERE_SYSSHAREDIR:-"/usr/share/monkeysphere"}
 export SYSSHAREDIR
 . "${SYSSHAREDIR}/common" || exit 1
 
-SYSDATADIR=${MONKEYSPHERE_SYSDATADIR:-"/var/lib/monkeysphere/host"}
+# sharedir for host functions
+MHSHAREDIR="${SYSSHAREDIR}/mh"
+
+SYSDATADIR=${MONKEYSPHERE_SYSDATADIR:-"/var/lib/monkeysphere"}
 export SYSDATADIR
 
 # UTC date in ISO 8601 format if needed
@@ -75,7 +78,7 @@ su_monkeysphere_user() {
     fi
 }
 
-# function to interact with the host gnupg keyring
+# function to interact with the gpg keyring
 gpg_host() {
     local returnCode
 
@@ -86,15 +89,7 @@ gpg_host() {
     # user to be able to read the host pubring.  we realize this might
     # be problematic, but it's the simplest solution, without too much
     # loss of security.
-    gpg --no-permission-warning "$@"
-    returnCode="$?"
-
-    # always reset the permissions on the host pubring so that the
-    # monkeysphere user can read the trust signatures
-    chgrp "$MONKEYSPHERE_USER" "${GNUPGHOME_HOST}/pubring.gpg"
-    chmod g+r "${GNUPGHOME_HOST}/pubring.gpg"
-    
-    return "$returnCode"
+    gpg "$@"
 }
 
 # output just key fingerprint
@@ -148,12 +143,10 @@ return $ret
 
 # unset variables that should be defined only in config file
 unset KEYSERVER
-unset AUTHORIZED_USER_IDS
-unset RAW_AUTHORIZED_KEYS
 unset MONKEYSPHERE_USER
 
 # load configuration file
-[ -e ${MONKEYSPHERE_SERVER_CONFIG:="${SYSCONFIGDIR}/monkeysphere-server.conf"} ] && . "$MONKEYSPHERE_SERVER_CONFIG"
+[ -e ${MONKEYSPHERE_HOST_CONFIG:="${SYSCONFIGDIR}/monkeysphere-host.conf"} ] && . "$MONKEYSPHERE_SERVER_CONFIG"
 
 # set empty config variable with ones from the environment, or with
 # defaults
@@ -165,20 +158,15 @@ MONKEYSPHERE_USER=${MONKEYSPHERE_MONKEYSPHERE_USER:=${MONKEYSPHERE_USER:="monkey
 
 # other variables
 CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:="true"}
-REQUIRED_USER_KEY_CAPABILITY=${MONKEYSPHERE_REQUIRED_USER_KEY_CAPABILITY:="a"}
-GNUPGHOME_HOST=${MONKEYSPHERE_GNUPGHOME_HOST:="${SYSDATADIR}/gnupg-host"}
-GNUPGHOME_AUTHENTICATION=${MONKEYSPHERE_GNUPGHOME_AUTHENTICATION:="${SYSDATADIR}/gnupg-authentication"}
+GNUPGHOME_HOST=${MONKEYSPHERE_GNUPGHOME_HOST:="${SYSDATADIR}/host"}
 
 # export variables needed in su invocation
 export DATE
 export MODE
-export MONKEYSPHERE_USER
 export LOG_LEVEL
+export MONKEYSPHERE_USER
 export KEYSERVER
-export CHECK_KEYSERVER
-export REQUIRED_USER_KEY_CAPABILITY
 export GNUPGHOME_HOST
-export GNUPGHOME_AUTHENTICATION
 export GNUPGHOME
 
 # get subcommand
@@ -188,53 +176,62 @@ shift
 
 case $COMMAND in
     'show-key'|'show'|'s')
-	show_server_key
+	check_host_keyring
+	show_key
 	;;
 
     'extend-key'|'e')
 	check_host_keyring
+	source "${MHSHAREDIR}/extend_key"
 	extend_key "$@"
 	;;
 
     'add-hostname'|'add-name'|'n+')
 	check_host_keyring
+	source "${MHSHAREDIR}/add_hostname"
 	add_hostname "$@"
 	;;
 
     'revoke-hostname'|'revoke-name'|'n-')
 	check_host_keyring
+	source "${MHSHAREDIR}/revoke_hostname"
 	revoke_hostname "$@"
 	;;
 
     'add-revoker'|'o')
 	check_host_keyring
+	source "${MHSHAREDIR}/add_revoker"
 	add_revoker "$@"
 	;;
 
     'revoke-key'|'r')
 	check_host_keyring
+	source "${MHSHAREDIR}/revoke_key"
 	revoke_key "$@"
 	;;
 
     'publish-key'|'publish'|'p')
 	check_host_keyring
-	publish_server_key
+	source "${MHSHAREDIR}/publish_key"
+	publish_key
 	;;
 
     'expert'|'e')
-	check_user
 	SUBCOMMAND="$1"
 	shift
 	case "$SUBCOMMAND" in
 	    'import-key'|'i')
+		source "${MHSHAREDIR}/import_key"
 		import_key "$@"
 		;;
 
 	    'gen-key'|'g')
+		source "${MHSHAREDIR}/gen_key"
 		gen_key "$@"
 		;;
 
 	    'diagnostics'|'d')
+		source "${MHSHAREDIR}/diagnostics"
 		diagnostics
 		;;
 
diff --git a/src/subcommands/ma/add-certifier b/src/subcommands/ma/add-certifier
index 9ad0515..0c3c647 100644
--- a/src/subcommands/ma/add-certifier
+++ b/src/subcommands/ma/add-certifier
@@ -60,7 +60,7 @@ if [ -z "$keyID" ] ; then
 fi
 if [ -f "$keyID" ] ; then
     echo "Reading key from file '$keyID':"
-    importinfo=$(gpg_authentication "--import" < "$keyID" 2>&1) || failure "could not read key from '$keyID'"
+    importinfo=$(gpg_sphere "--import" < "$keyID" 2>&1) || failure "could not read key from '$keyID'"
     # FIXME: if this is tried when the key database is not
     # up-to-date, i got these errors (using set -x):
 
@@ -83,13 +83,13 @@ if [ -f "$keyID" ] ; then
     fi
 else
     # get the key from the key server
-    gpg_authentication "--keyserver $KEYSERVER --recv-key '0x${keyID}!'" || failure "Could not receive a key with this ID from the '$KEYSERVER' keyserver."
+    gpg_sphere "--keyserver $KEYSERVER --recv-key '0x${keyID}!'" || failure "Could not receive a key with this ID from the '$KEYSERVER' keyserver."
 fi
 
 export keyID
 
 # get the full fingerprint of a key ID
-fingerprint=$(gpg_authentication "--list-key --with-colons --with-fingerprint 0x${keyID}!" | \
+fingerprint=$(gpg_sphere "--list-key --with-colons --with-fingerprint 0x${keyID}!" | \
     grep '^fpr:' | grep "$keyID" | cut -d: -f10)
 
 if [ -z "$fingerprint" ] ; then
@@ -98,7 +98,7 @@ fi
 
 echo
 echo "key found:"
-gpg_authentication "--fingerprint 0x${fingerprint}!"
+gpg_sphere "--fingerprint 0x${fingerprint}!"
 
 echo "Are you sure you want to add the above key as a"
 read -p "certifier of users on this system? (y/N) " OK; OK=${OK:-N}
@@ -107,7 +107,7 @@ if [ "${OK/y/Y}" != 'Y' ] ; then
 fi
 
 # export the key to the host keyring
-gpg_authentication "--export 0x${fingerprint}!" | gpg_host --import
+gpg_sphere "--export 0x${fingerprint}!" | gpg_core --import
 
 if [ "$trust" = marginal ]; then
     trustval=1
@@ -132,10 +132,10 @@ EOF
 
 # ltsign the key
 if echo "$ltsignCommand" | \
-    gpg_host --quiet --command-fd 0 --edit-key "0x${fingerprint}!" ; then
+    gpg_core --quiet --command-fd 0 --edit-key "0x${fingerprint}!" ; then
 
     # update the trustdb for the authentication keyring
-    gpg_authentication "--check-trustdb"
+    gpg_sphere "--check-trustdb"
 
     echo
     echo "Identity certifier added."
diff --git a/src/subcommands/ma/list-certifiers b/src/subcommands/ma/list-certifiers
index 83f7786..e37485e 100644
--- a/src/subcommands/ma/list-certifiers
+++ b/src/subcommands/ma/list-certifiers
@@ -19,12 +19,12 @@ local keys
 local key
 
 # find trusted keys in authentication keychain
-keys=$(gpg_authentication "--no-options --list-options show-uid-validity --keyring ${GNUPGHOME_AUTHENTICATION}/pubring.gpg --list-keys --with-colons --fingerprint" | \
+keys=$(gpg_sphere "--no-options --list-options show-uid-validity --keyring ${GNUPGHOME_AUTHENTICATION}/pubring.gpg --list-keys --with-colons --fingerprint" | \
     grep ^pub: | cut -d: -f2,5 | egrep '^(u|f):' | cut -d: -f2)
 
 # output keys
 for key in $keys ; do
-    gpg_authentication "--no-options --list-options show-uid-validity --keyring ${GNUPGHOME_AUTHENTICATION}/pubring.gpg --list-key --fingerprint $key"
+    gpg_sphere "--no-options --list-options show-uid-validity --keyring ${GNUPGHOME_AUTHENTICATION}/pubring.gpg --list-key --fingerprint $key"
 done
 
 }
diff --git a/src/subcommands/ma/remove-certifier b/src/subcommands/ma/remove-certifier
index 59d3f0c..560281d 100644
--- a/src/subcommands/ma/remove-certifier
+++ b/src/subcommands/ma/remove-certifier
@@ -23,7 +23,7 @@ if [ -z "$keyID" ] ; then
     failure "You must specify the key ID of a key to remove."
 fi
 
-if gpg_authentication "--no-options --list-options show-uid-validity --keyring ${GNUPGHOME_AUTHENTICATION}/pubring.gpg --list-key 0x${keyID}!" ; then
+if gpg_sphere "--no-options --list-options show-uid-validity --keyring ${GNUPGHOME_AUTHENTICATION}/pubring.gpg --list-key 0x${keyID}!" ; then
     read -p "Really remove above listed identity certifier? (y/N) " OK; OK=${OK:-N}
     if [ "${OK/y/Y}" != 'Y' ] ; then
 	failure "Identity certifier not removed."
@@ -33,12 +33,12 @@ else
 fi
 
 # delete the requested key
-if gpg_authentication "--delete-key --batch --yes 0x${keyID}!" ; then
+if gpg_sphere "--delete-key --batch --yes 0x${keyID}!" ; then
     # delete key from host keyring as well
-    gpg_host --delete-key --batch --yes "0x${keyID}!"
+    gpg_core --delete-key --batch --yes "0x${keyID}!"
 
     # update the trustdb for the authentication keyring
-    gpg_authentication "--check-trustdb"
+    gpg_sphere "--check-trustdb"
 
     echo
     echo "Identity certifier removed."
diff --git a/src/subcommands/ma/update-users b/src/subcommands/ma/update-users
index 0335e31..73685f6 100644
--- a/src/subcommands/ma/update-users
+++ b/src/subcommands/ma/update-users
@@ -13,6 +13,11 @@
 
 update_users() {
 
+local unames
+local uname
+local authorizedKeysDir
+local authorizedUserIDs
+
 if [ "$1" ] ; then
     # get users from command line
     unames="$@"
@@ -21,13 +26,16 @@ else
     unames=$(getent passwd | cut -d: -f1)
 fi
 
-RETCODE=0
+RETURN=0
 
 # set mode
 MODE="authorized_keys"
 
 # set gnupg home
-GNUPGHOME="$GNUPGHOME_AUTHENTICATION"
+GNUPGHOME="$GNUPGHOME_SPHERE"
+
+# the authorized_keys directory
+authorizedKeysDir="${SYSDATADIR}/authentication/authorized_keys"
 
 # check to see if the gpg trust database has been initialized
 if [ ! -s "${GNUPGHOME}/trustdb.gpg" ] ; then
@@ -35,7 +43,7 @@ if [ ! -s "${GNUPGHOME}/trustdb.gpg" ] ; then
 fi
 
 # make sure the authorized_keys directory exists
-mkdir -p "${SYSDATADIR}/authorized_keys"
+mkdir -p "${authorizedKeysDir}"
 
 # loop over users
 for uname in $unames ; do
@@ -48,7 +56,7 @@ for uname in $unames ; do
     log verbose "----- user: $uname -----"
 
     # make temporary directory
-    TMPLOC=$(mktemp -d ${MSTMPDIR}/tmp.XXXXXXXXXX) || failure "Could not create temporary directory!"
+    TMPLOC=$(mktemp -d ${MATMPDIR}/tmp.XXXXXXXXXX) || failure "Could not create temporary directory!"
 
     # trap to delete temporary directory on exit
     trap "rm -rf $TMPLOC" EXIT
@@ -128,15 +136,15 @@ for uname in $unames ; do
 	chown $(whoami) "$AUTHORIZED_KEYS" && \
 	    chgrp $(id -g "$uname") "$AUTHORIZED_KEYS" && \
 	    chmod g+r "$AUTHORIZED_KEYS" && \
-	    mv -f "$AUTHORIZED_KEYS" "${SYSDATADIR}/authorized_keys/${uname}" || \
+	    mv -f "$AUTHORIZED_KEYS" "${authorizedKeysDir}/${uname}" || \
 	    { 
 	    log error "Failed to install authorized_keys for '$uname'!"
-	    rm -f "${SYSDATADIR}/authorized_keys/${uname}"
+	    rm -f "${authorizedKeysDir}/${uname}"
 	    # indicate that there has been a failure:
 	    RETURN=1
 	}
     else
-	rm -f "${SYSDATADIR}/authorized_keys/${uname}"
+	rm -f "${authorizedKeysDir}/${uname}"
     fi
 
     # unset the trap
diff --git a/src/subcommands/mh/publish-key b/src/subcommands/mh/publish-key
index 6c69569..b7ab01d 100644
--- a/src/subcommands/mh/publish-key
+++ b/src/subcommands/mh/publish-key
@@ -24,6 +24,8 @@ fi
 fingerprint=$(fingerprint_server_key)
 
 # publish host key
-gpg_authentication "--keyserver $KEYSERVER --send-keys '0x${fingerprint}!'"
+# FIXME: need to define how to do this
+#gpg_authentication "--keyserver $KEYSERVER --send-keys '0x${fingerprint}!'"
+echo "not published!!!"
 
 }
diff --git a/tests/basic b/tests/basic
index 7fdca39..0d78053 100755
--- a/tests/basic
+++ b/tests/basic
@@ -5,7 +5,9 @@
 # Authors: 
 #   Daniel Kahn Gillmor <dkg@fifthhorseman.net>
 #   Jameson Rollins <jrollins@fifthhorseman.net>
-# Copyright: 2008
+#   Micah Anderson <micah@riseup.net> 
+#
+# Copyright: 2008-2009
 # License: GPL v3 or later
 
 # these tests should all be able to run as a non-privileged user.
@@ -163,22 +165,22 @@ cp etc/ssh/sshd_config "$SSHD_CONFIG"
 # write the sshd_config
 cat <<EOF >> "$SSHD_CONFIG"
 HostKey ${MONKEYSPHERE_SYSDATADIR}/ssh_host_rsa_key
-AuthorizedKeysFile ${MONKEYSPHERE_SYSDATADIR}/authorized_keys/%u
+AuthorizedKeysFile ${MONKEYSPHERE_SYSDATADIR}/authentication/authorized_keys/%u
 EOF
 
 # set up monkeysphere-server
 echo "### configuring monkeysphere..."
-mkdir -p -m 750 "$MONKEYSPHERE_SYSDATADIR"/gnupg-host
-mkdir -p -m 700 "$MONKEYSPHERE_SYSDATADIR"/gnupg-authentication
-mkdir -p -m 700 "$MONKEYSPHERE_SYSDATADIR"/authorized_keys
+mkdir -p -m 750 "$MONKEYSPHERE_SYSDATADIR"/host
+mkdir -p -m 700 "$MONKEYSPHERE_SYSDATADIR"/authentication
+mkdir -p -m 700 "$MONKEYSPHERE_SYSDATADIR"/authentication/authorized_keys
 mkdir -p -m 700 "$MONKEYSPHERE_SYSDATADIR"/tmp
 cp etc/monkeysphere/monkeysphere-server.conf "$TEMPDIR"/monkeysphere-server.conf
 cat <<EOF >> "$TEMPDIR"/monkeysphere-server.conf
-AUTHORIZED_USER_IDS="$MONKEYSPHERE_HOME/authorized_user_ids"
+AUTHORIZED_USER_IDS="$MONKEYSPHERE_HOME/authentication/authorized_user_ids"
 EOF
-cat <<EOF > "$MONKEYSPHERE_SYSDATADIR"/gnupg-authentication/gpg.conf
-primary-keyring ${MONKEYSPHERE_SYSDATADIR}/gnupg-authentication/pubring.gpg
-keyring ${MONKEYSPHERE_SYSDATADIR}/gnupg-host/pubring.gpg
+cat <<EOF > "$MONKEYSPHERE_SYSDATADIR"/authentication/sphere/gpg.conf
+primary-keyring ${MONKEYSPHERE_SYSDATADIR}/authentication/sphere/pubring.gpg
+keyring ${MONKEYSPHERE_SYSDATADIR}/authentication/core/pubring.gpg
 EOF
 
 
@@ -188,16 +190,16 @@ EOF
 echo "### generating server key..."
 # add gpg.conf with quick-random
 get_gpg_prng_arg >> "$MONKEYSPHERE_SYSCONFIGDIR"/gnupg-host/gpg.conf
-echo | monkeysphere-server gen-key --length 1024 --expire 0 testhost
+echo | monkeysphere-host expert gen-key --length 1024 --expire 0 testhost
 # remove the gpg.conf
 rm "$MONKEYSPHERE_SYSCONFIGDIR"/gnupg-host/gpg.conf
 
-HOSTKEYID=$( monkeysphere-server show-key | grep '^OpenPGP fingerprint: ' | cut -f3 -d\  )
+HOSTKEYID=$( monkeysphere-host show-key | grep '^OpenPGP fingerprint: ' | cut -f3 -d\  )
 
 # certify it with the "Admin's Key".
 # (this would normally be done via keyservers)
 echo "### certifying server key..."
-monkeysphere-server gpg-authentication-cmd "--armor --export $HOSTKEYID" | gpgadmin --import
+monkeysphere-authentication expert gpg-cmd "--armor --export $HOSTKEYID" | gpgadmin --import
 echo y | gpgadmin --command-fd 0 --sign-key "$HOSTKEYID"
 
 # FIXME: how can we test publish-key without flooding junk into the
@@ -205,7 +207,7 @@ echo y | gpgadmin --command-fd 0 --sign-key "$HOSTKEYID"
 
 # add admin as identity certifier for testhost
 echo "### adding admin as certifier..."
-echo y | monkeysphere-server add-identity-certifier "$TEMPDIR"/admin/.gnupg/pubkey.gpg
+echo y | monkeysphere-authentication add-id-certifier "$TEMPDIR"/admin/.gnupg/pubkey.gpg
 
 
 ### TESTUSER TESTS
@@ -220,9 +222,9 @@ gpgadmin --armor --export "$HOSTKEYID" | gpg --import
 
 # teach the "server" about the testuser's key
 echo "### export testuser key to server..."
-gpg --export testuser | monkeysphere-server gpg-authentication-cmd --import
+gpg --export testuser | monkeysphere-authentication gpg-cmd --import
 echo "### update server authorized_keys file for this testuser..."
-monkeysphere-server update-users $(whoami)
+monkeysphere-authentication update-users $(whoami)
 
 # connect to test sshd, using monkeysphere-ssh-proxycommand to verify
 # the identity before connection.  This should work in both directions!
@@ -233,7 +235,7 @@ ssh_test
 # sure that the ssh authentication FAILS
 echo "### removing testuser authorized_user_ids and updating..."
 mv "$TESTHOME"/.monkeysphere/authorized_user_ids{,.bak}
-monkeysphere-server update-users $(whoami)
+monkeysphere-authentication update-users $(whoami)
 echo "### ssh connection test for server authentication denial..."
 ssh_test 255
 mv "$TESTHOME"/.monkeysphere/authorized_user_ids{.bak,}
@@ -242,13 +244,13 @@ mv "$TESTHOME"/.monkeysphere/authorized_user_ids{.bak,}
 # make sure ssh authentication FAILS
 echo "### setting group writability on authorized_user_ids and updating..."
 chmod g+w "$TESTHOME"/.monkeysphere/authorized_user_ids
-monkeysphere-server update-users $(whoami)
+monkeysphere-authentication update-users $(whoami)
 echo "### ssh connection test for server authentication denial..."
 ssh_test 255
 chmod g-w "$TESTHOME"/.monkeysphere/authorized_user_ids
 echo "### setting other writability on authorized_user_ids and updating..."
 chmod o+w "$TESTHOME"/.monkeysphere/authorized_user_ids
-monkeysphere-server update-users $(whoami)
+monkeysphere-authentication update-users $(whoami)
 echo "### ssh connection test for server authentication denial..."
 ssh_test 255
 chmod o-w "$TESTHOME"/.monkeysphere/authorized_user_ids