may be used in place of `update-users.
.TP
.B gen-key
-Generate a gpg key for the host. `g' may be used in place of
+Generate a gpg key pair for the host. `g' may be used in place of
`gen-key'.
.TP
.B show-fingerprint
Publish the host's gpg key to the keyserver. `p' may be used in place
of `publish-key'.
.TP
-.B trust-key KEYID [LEVEL]
-Set owner trust for key. If LEVEL is not specified, then the program
+.B add-certifier KEYID
+Add a certifier key to host keyring. The key with specified key ID
+will be retrieved from the keyserver and imported to the host keyring.
+It will then be given a non-exportable trust signature, with default
+depth of 1, so that the key may certifier users to log into the
+system. `a' may be used in place of `add-certifier'.
+.TP
+.B remove-certifier KEYID
+Remove a certifier key from the host keyring. The key with specified
+key ID will be removed entirely from the host keyring so that the key
+will not longer be able to certify users on the system. `r' may be
+used in place of `remove-certifier'.
+.TP
+.B list-certifiers KEYID
+Add key to certify system users. If LEVEL is not specified, then the program
will prompt for an owner trust level to set for KEYID. This function
-lsigns the key as well so that it will have a known validity. `t' may
-be used in place of `trust-key'.
+lsigns the key as well so that it will have a known validity. `l' may
+be used in place of `list-certifiers'.
.TP
.B help
Output a brief usage summary. `h' or `?' may be used in place of
.SH SETUP
-In order to start using the monkeysphere, there are a couple of things
-you need to do first. The first is to generate an OpenPGP key for the
-server and convert that key to an ssh key that can be used by ssh for
-host authentication. To do this, run the "gen-key" subcommand. Once
-that is done, publish the key to a keyserver with "publish-key"
-subcommand. Finally, you need to modify the sshd_config to tell sshd
-where the new server host key:
+In order to start using the monkeysphere, you must first generate an
+OpenPGP key for the server and convert that key to an ssh key that can
+be used by ssh for host authentication. To do this, run the "gen-key"
+subcommand to generate the host key pair:
+
+$ monkeysphere-server gen-key
+
+To enable host verification via the monkeysphere, you must then
+publish the host's key to the Web of Trust using the "publish-key"
+command to push the key to a keyserver. Then modify the sshd_config
+to tell sshd where the new server host key is located:
HostKey /var/lib/monkeysphere/ssh_host_rsa_key
+For users logging into the system to be able to verify the host via
+the monkeysphere, at least one person (ie. a server admin) will need
+to sign the host's key. This is done in the same way that key signing
+is usually done, by pulling the host's key from the keyserver, signing
+the key, and re-publishing the signature. Once that is done, users
+logging into the host will be able to certify the host's key via the
+signature of the host admin.
+
If the server will also handle user authentication through
-monkeysphere-generated authorized_keys files, set the following:
+monkeysphere-generated authorized_keys files, the server must be told
+which keys will act as user certifiers. This is done with the
+"add-certifier" command:
+
+$ monkeysphere-server add-certifier KEYID
+
+where KEYID is the key ID of the server admin, or whoever's signature
+will be certifying users to the system. Certifiers can be later
+remove with the "remove-certifier" command, and listed with the
+"list-certifiers" command.
+
+Remote user's will then be granted access to a local user account
+based on the appropriately signed and valid keys associated with user
+IDs listed in the authorized_user_ids file of the local user. By
+default, the authorized_user_ids file for local users is found in
+~/.config/monkeysphere/authorized_user_ids. This can be changed in
+the monkeysphere-server.conf file.
+
+The "update-users" command can then be used to generate
+authorized_keys file for local users that sshd can use to grant access
+to user accounts for remote users:
+
+$ monkeysphere-server update-users [USER]
+
+If no user is specified, authorized_keys files will be generated for
+all users on the system. You must also tell sshd to look at the
+monkeysphere-generated authorized_keys file for user authentication by
+setting the following in the sshd_config:
AuthorizedKeysFile /var/lib/monkeysphere/authorized_keys/%u
-Once those changes are made, restart the ssh server.
+It is recommended to add "monkeysphere-server update-users" to a
+system crontab, so that user keys are kept up-to-date, and key
+revokations and expirations can be processed in a timely manor.
.SH FILES
projects / monkeysphere.git / blobdiff