With your keyring updated, you want to make sure that OpenSSH can
still see the most recent trusted information about who the various
hosts are. This can be done with the monkeysphere-ssh-proxycommand
-(see next section) or with the update-known_hosts command:
+(see next section) or with the `update-known_hosts` command:
$ monkeysphere update-known_hosts
-This command will check to see if there is an OpenPGP key for
-each (non-hashed) host listed in the known_hosts file, and then add
-the key for that host to the known_hosts file if one is found. This
+This command will check to see if there is an OpenPGP key for each
+(non-hashed) host listed in the `known_hosts` file, and then add the
+key for that host to the `known_hosts` file if one is found. This
command could be added to a crontab as well, if desired.
----------------------------------------
The best way to handle host keys is to use the monkeysphere ssh proxy
-command. This command will make sure the known_hosts file is
+command. This command will make sure the `known_hosts` file is
up-to-date for the host you are connecting to with ssh. The best way
to integrate this is to add the following line to the "Host *" section
of your `~/.ssh/config` file:
then connect to a test server that is signed by this gpg key so users
can establish that they are setup correctly.
-The remaining steps will complete the second half: allow servers to
+The remaining steps will complete the second half: allowing servers to
verify you based on your OpenPGP key.
Setting up an OpenPGP authentication key
----------------------------------------
-First things first: you'll need to create a new subkey for your
-current key, if you don't already have one. If you already have a GPG
-key, you can add a subkey with:
+First things first: you'll need to create an "authentication" subkey
+for your current key, if you don't already have one. If you already
+have a GPG key, you can add an authentication subkey with:
$ monkeysphere gen-subkey
If you have more than one secret key, you'll need to specify the key
-you want to add a subkey to on the command line.
+you want to add the subkey to on the command line.
Using your OpenPGP authentication key for SSH
---------------------------------------------
-Once you have created an OpenPGP authentication key, you will need to
-feed it to your ssh agent.
+Once you have created an OpenPGP authentication subkey, you will need
+to feed it to your ssh agent.
Currently (2008-08-23), gnutls does not support this operation. In order
to take this step, you will need to upgrade to a patched version of
FIXME: using the key with a single ssh connection?
+Establish trust
+---------------
+
+Now that you have the above setup, you will need to establish an
+acceptable trust path to the admin(s) of a monkeysphere-enabled server
+that you will be connecting to. You need to do this because the admin
+is certifying the host, and you need a mechanism to validate that
+certification. The only way to do that is by indicating who you trust
+to certify hosts. This is a two step process: first you must sign the
+key, and then you have to indicate a trust level.
+
+The process of signing another key is outside the scope of this
+document, however the gnupg README details the signing process and you
+can find good [documentation
+](http://www.debian.org/events/keysigning) online detailing this
+process.
+
+If you have signed your admins' key, you need to denote some kind of
+trust to that key. To do this you should edit the key and use the
+'trust' command. For the Monkeysphere to trust the assertions that are
+made about a host, you need full calculated validity to the host
+certifiers. This can be done either by giving full trust to one
+host-certifying key, or by giving marginal trust to three different
+host-certifiers. In the following we demonstrate how to add full trust
+validity to a host-certifying key:
+
+ $ gpg --edit-key <admin_keyid>
+ Command> trust
+ pub 2048R/3B757F8C created: 2008-06-19 expires: 2008-11-16 usage: CA
+ trust: unknown validity: full
+ [ unknown ] (1). ssh://monkeysphere.info
+ [ unknown ] (2) ssh://george.riseup.net
+
+ Please decide how far you trust this user to correctly verify other users' keys
+ (by looking at passports, checking fingerprints from different sources, etc.)
+
+ 1 = I don't know or won't say
+ 2 = I do NOT trust
+ 3 = I trust marginally
+ 4 = I trust fully
+ 5 = I trust ultimately
+ m = back to the main menu
+
+ Your decision? 4
+
+Note: Due to a limitation with gnupg, it is not currently possible to
+limit the domain scope properly, which means that if you fully trust
+an admin, this admin can currently assert host verification for any
+hosts.
+
+Because the Monkeysphre relies on GPG's definition of the OpenPGP web
+of trust, it is important to understand [how GPG calculates User ID
+validity for a key](/trust-models).
+
Miscellaneous
-------------
Users can also maintain their own `~/.ssh/authorized_keys` files with
the Monkeysphere. This is primarily useful for accounts on hosts that
-are not already systematically using the monkeysphere for user
+are not already systematically using the Monkeysphere for user
authentication. If you're not sure whether this is the case for your
host, ask your system administrator.
If you want to do this as a regular user, use the
-update-authorized_keys command:
+`update-authorized_keys` command:
$ monkeysphere update-authorized_keys
This command will take all the user IDs listed in the
-`~/.config/monkeysphere/authorized_user_ids` file and check to see if
+`~/.monkeysphere/authorized_user_ids` file and check to see if
there are acceptable keys for those user IDs available. If so, they
will be added to the `~/.ssh/authorized_keys` file.
projects / monkeysphere.git / blobdiff