release: clean
rm -rf monkeysphere-$(MONKEYSPHERE_VERSION)
mkdir -p monkeysphere-$(MONKEYSPHERE_VERSION)/doc
- ln -s ../../doc/README ../../doc/README.admin ../../doc/TODO ../../doc/MonkeySpec monkeysphere-$(MONKEYSPHERE_VERSION)/doc
+ ln -s ../../website/getting-started-user.mdwn ../../website/getting-started-admin.mdwn ../../doc/TODO ../../doc/MonkeySpec monkeysphere-$(MONKEYSPHERE_VERSION)/doc
ln -s ../COPYING ../etc ../Makefile ../man ../src monkeysphere-$(MONKEYSPHERE_VERSION)
tar -ch monkeysphere-$(MONKEYSPHERE_VERSION) | gzip -n > monkeysphere_$(MONKEYSPHERE_VERSION).orig.tar.gz
rm -rf monkeysphere-$(MONKEYSPHERE_VERSION)
-monkeysphere (0.12-1) UNRELEASED; urgency=low
+monkeysphere (0.13~pre-1) UNRELEASED; urgency=low
+ [ Daniel Kahn Gillmor ]
+ * tweaks in /usr/bin/monkeysphere to handle odd secret keyrings.
+
+ -- Daniel Kahn Gillmor <dkg@fifthhorseman.net> Tue, 02 Sep 2008 21:28:51 -0400
+
+monkeysphere (0.12-1) experimental; urgency=low
+
+ [ Jameson Graef Rollins ]
* Improved output handling. New LOG_LEVEL variable.
+
+ [ Daniel Kahn Gillmor ]
* debian/control: switched Homepage: and Vcs-Git: to canonicalized
upstream hostnames.
+ * updated documentation for new release.
+ * changed my associated e-mail address for this package.
- -- Jameson Graef Rollins <jrollins@phys.columbia.edu> Mon, 01 Sep 2008 23:55:56 -0700
+ -- Daniel Kahn Gillmor <dkg@fifthhorseman.net> Tue, 02 Sep 2008 18:54:29 -0400
monkeysphere (0.11-1) experimental; urgency=low
Source: monkeysphere
Section: net
Priority: extra
-Maintainer: Daniel Kahn Gillmor <dkg-debian.org@fifthhorseman.net>
+Maintainer: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Uploaders: Jameson Rollins <jrollins@fifthhorseman.net>
Build-Depends: debhelper (>= 7.0), libgnutls-dev (>= 2.4.0), git-core
Standards-Version: 3.8.0.1
-doc/README
-doc/README.admin
+website/getting-started-user.mdwn
+website/getting-started-admin.mdwn
doc/MonkeySpec
THE MONKEYSPHERE
================
-AGENDA
-======
-[x] clowning
-[ ] work
-[x] jrollins will talk and gesture - in progress
-
-MONKEYNAMES
-===========
-
-rhesus, marmoset, howler, langur, tamarin, barbary
-
-COMPONENTS
-==========
-
-(names in "" are code names until we think of better ones.)
-
-common components
------------------
-* "rhesus": update known_hosts/authorized_keys files:
- - be responsible for removing keys from the file as key revocation
- happens
- - be responsible for updating a key in the file where there is a key
- replacement
- - must result in a file that is parsable by the existing ssh client
- without errors
- - manual management must be allowed without stomping on it
- - provide a simple, intelligible, clear policy for key acceptance
-
-* "langur": policy-editor for viewing/editing policies
-
-* gpg2ssh: utility to convert gpg keys to ssh
- known_hosts/authorized_keys lines
-
-* ssh2gpg: create openpgp keypair from ssh keypair
+Monkeysphere is authentication layer that allows the sysadmin to
+perform authorization on OpenPGP user identities instead of on keys.
+It also allows end users to authenticate/identify the ssh server they
+are connecting to by checking the sysadmin's certification.
-server-side components
-----------------------
-* "howler": server gpg maintainer
- - generate gpg keys for the server
- - publish server gpg keys
- - give owner trust to keys for user authentication
+* GENERAL GOAL - use openpgp web-of-trust to authenticate ppl for SSH
+* SPECIFIC GOAL - allow openssh to tie into pgp web-of-trust without
+ modifying the openpgp spec, gpg or openssh
+* DESIGN GOALS - authentication, use the existing generic OpenSSH
+ client, the admin can make it default, although end-user should be
+ decide to use monkeysphere or not
+* DESIGN GOAL - use of monkeysphere should not radically change
+ connecting-to-server experience
-* "tamarin": concept - how to trigger or schedule rhesus at admin defined
- points (e.g. via cron or during ssh connections).
+Host identity piece of monkeysphere could be used without buying into
+the user authentication component.
-client-side components
-----------------------
-* "marmoset": concept - how to trigger rhesus during attempt to initiate
- connection to server
- - runs on connection to a certain host
- - triggers update to known_hosts file then makes connection
- - proxy-command | pre-hook script | wrapper script
- - (ssh_config "LocalCommand" is only run *after* connection)
USE CASE
========
have both signed each other's keys and marked each others keys with
"full" ownertrust.
-When Alice set up mangabey initially, she used howler to publish a gpg
-key for the machine with the special userid of
-"ssh://mangabey.example.org". She also signed mangabey's gpg key and
-published this certification to commonly-used keyservers. Alice also
-configured mangabey to treat her own key with full ownertrust (could
-this be done as part of the howler invocation?)
+When Alice set up mangabey initially, she published an OpenPGP key for
+the machine with the special userid of "ssh://mangabey.example.org".
+She also signed mangabey's OpenPGP key and published this
+certification to commonly-used keyservers. Alice also configured
+mangabey to treat her own key with full ownertrust, so that it knows
+how to identify connecting users.
Now, Alice creates a user account "bob" on mangabey, and puts Bob's
userid ("Bob <bob@example.org>") in the authorized_user_ids file for
-user bob on mangabey. tamarin triggers on mangabey either by a
-cronjob or an inotify hook, and invokes rhesus for the "bob" account.
-rhesus automatically takes each userid in bob's authorized_user_ids
-file, and looks on a keyserver to find all public keys associated with
-that user ID, with the goal of populating the authorized_keys file for
-bob@mangabey.
+user bob on mangabey. The monkeysphere automatically (via cron or
+inotify hook) takes each userid in bob's authorized_user_ids file, and
+looks on a keyserver to find all public keys associated with that user
+ID, with the goal of populating the authorized_keys file for
+bob@mangabey.
In particular: for each key found, the server evaluates the calculated
validity of the specified user ID based on the ownertrust rules it has
configured ("trust alice's certifications fully", in this example).
For each key for which the user ID in question is fully-valid, it
extracts all DSA- or RSA-based primary or secondary keys marked with
-usage flags for encrypted communications and authentication, and
-converts these gpg public keys into ssh public keys. Finally, rhesus
-inserts these calculated public keys into the authorized_keys file for
-bob.
+the authentication usage flag, and converts these OpenPGP public keys
+into ssh public keys. These keys are automatically placed into the
+authorized_keys file for bob.
Bob now attempts to connect, by firing up a terminal and invoking:
"ssh bob@mangabey.example.org". Bob's monkeysphere-enabled ssh client
notices that mangabey.example.org isn't already available in bob's
-known_hosts file, and triggers rhesus (on Bob's computer) to fetch the
-key for mangabey, with the goal of populating Bob's local known_hosts
+known_hosts file, and fetches the host key for mangabey from the
+public keyservers, with the goal of populating Bob's local known_hosts
file.
-In particular: rhesus queries its configured keyservers to find all
-public keys with User ID ssh://mangabey.example.org. For each public
-key found, rhesus checks the relevant User ID's validity, converts any
-"encrypted comms, authentication" gpg public keys into ssh public keys
-if the User ID validity is acceptable, and finally insert those keys
-into Bob's known_hosts file.
+In particular: the monkeysphere queries its configured keyservers to
+find all public keys with User ID ssh://mangabey.example.org. For
+each public key found, it checks the relevant User ID's validity,
+converts any authentication-capable OpenPGP public keys into ssh
+public keys if the User ID validity is acceptable, and finally insert
+those keys into Bob's known_hosts file.
On Bob's side, since mangabey's key had "full" validity (it was signed
-by Alice whom he fully trusts), Bob's ssh client deems mangabey
+by Alice, whom he fully trusts), Bob's ssh client deems mangabey
"known" and no further host key checking is required.
On mangabey's side, since Bob's key has "full" validity (it had been
signed by Alice, mangabey's trusted administrator), Bob is
authenticated and therefore authorized to log into his account.
-NOTES
-=====
-
-* Daniel and Elliot lie. <check>
-* We will use a distributed VCS, each developer will create their own
- git repository and publish it publicly for others to pull from, mail
- out
-* public project page doesn't perhaps make sense yet
-* approximate goal - using the web of trust to authenticate ppl for
- SSH
-* outline of various components of monkeysphere
-* M: what does it mean to be in the monkeysphere? not necessarily a
- great coder.
-* J: interested in seeing project happen, not in actually doing it.
- anybody can contribute as much as they want.
-* J: if we put the structure in place to work on monkeysphere then we
- don't have to do anything
-* D: we are not creating
-* understand gpg's keyring better, understanding tools better,
- building scripts
-* Some debian packages allow automated configuration of config files.
-
-* GENERAL GOAL - use openpgp web-of-trust to authenticate ppl for SSH
-* SPECIFIC GOAL - allow openssh to tie into pgp web-of-trust without
- modifying either openpgp and openssh
-* DESIGN GOALS - authentication, use the existing generic OpenSSH
- client, the admin can make it default, although end-user should be
- decide to use monkeysphere or not
-* DESIGN GOAL - use of monkeysphere should not radically change
- connecting-to-server experience
-* GOAL - pick a monkey-related name for each component
-
-Host identity piece of monkeysphere could be used without buying into
-the authorization component.
-
-Monkeysphere is authentication layer that allows the sysadmin to
-perform authorization on user identities instead of on keys, it
-additionally allows the sysadmin also to authenticate the server to
-the end-user.
-
-see doc/git-init for more detail on how to pull from the distributed
-repositories.
+++ /dev/null
-../website/getting-started-user.mdwn
\ No newline at end of file
+++ /dev/null
-../website/getting-started-admin.mdwn
\ No newline at end of file
--- /dev/null
+use IkiWiki::Setup::Standard {
+ wikiname => "Monkeysphere",
+ adminemail => 'webmaster@monkeysphere.info',
+
+ srcdir => "/path/to/cloned/monkeysphere/repo/website",
+ destdir => "/path/to/web/dir",
+
+ url => "http://monkeysphere.info",
+
+ rcs => "git",
+
+ wrappers => [
+ {
+ wrapper => "/path/to/post-receive/hook",
+ wrappermode => "0755",
+ }
+ ],
+
+ rss => 1,
+ atom => 1,
+ verbose => 0,
+ syslog => 0,
+
+ add_plugins => [qw{goodstuff favicon toc sidebar}],
+
+
+ tagbase => "tags",
+
+}
.SH KEYSERVER CHECKING
The proxy command has a fairly nuanced policy for when keyservers are
-queried when processing host. If the host userID is not found in
+queried when processing a host. If the host userID is not found in
either the user's keyring or in the known_hosts file, then the
keyserver is queried for the host userID. If the host userID is found
in the user's keyring, then the keyserver is not checked. This
All environment variables defined in monkeysphere(1) can also be used
for the proxy command, with one note:
-.TP
-MONKEYSPHERE_LOG_LEVEL
-Set the log level. Can be SILENT, ERROR, INFO, DEBUG, in increasing
-order of verbosity.
-
.TP
MONKEYSPHERE_CHECK_KEYSERVER
Setting this variable (to `true' or `false') will override the policy
the monkeysphere.conf configuration file (defaults in parentheses):
.TP
MONKEYSPHERE_LOG_LEVEL
-Set the log level. Can be SILENT, ERROR, INFO, DEBUG, in increasing
-order of verbosity.
+Set the log level (INFO). Can be SILENT, ERROR, INFO, VERBOSE, DEBUG,
+in increasing order of verbosity.
.TP
MONKEYSPHERE_GNUPGHOME, GNUPGHOME
GnuPG home directory (~/.gnupg).
parentheses):
.TP
MONKEYSPHERE_LOG_LEVEL
-Set the log level. Can be SILENT, ERROR, INFO, DEBUG, in increasing
-order of verbosity.
+Set the log level (INFO). Can be SILENT, ERROR, INFO, VERBOSE, DEBUG, in
+increasing order of verbosity.
.TP
MONKEYSPHERE_KEYSERVER
OpenPGP keyserver to use (subkeys.pgp.net).
# list in decreasing verbosity (all caps).
# separate with $IFS explicitly, since we do some fancy footwork
# elsewhere.
- alllevels="DEBUG${IFS}INFO${IFS}ERROR"
+ alllevels="DEBUG${IFS}VERBOSE${IFS}INFO${IFS}ERROR"
# translate lowers to uppers in global log level
LOG_LEVEL=$(echo "$LOG_LEVEL" | tr "[:lower:]" "[:upper:]")
# if the gpg query return code is not 0, return 1
if [ "$?" -ne 0 ] ; then
- log info " no primary keys found."
+ log verbose " no primary keys found."
return 1
fi
lastKeyOK=
fingerprint=
- log info " primary key found: $keyid"
+ log verbose " primary key found: $keyid"
# if overall key is not valid, skip
if [ "$validity" != 'u' -a "$validity" != 'f' ] ; then
# output a line for the primary key
# 0 = ok, 1 = bad
if [ "$keyOK" -a "$uidOK" -a "$lastKeyOK" ] ; then
- log info " * acceptable primary key."
+ log verbose " * acceptable primary key."
if [ -z "$sshKey" ] ; then
log error " ! primary key could not be translated (not RSA or DSA?)."
else
# output a line for the sub key
# 0 = ok, 1 = bad
if [ "$keyOK" -a "$uidOK" -a "$lastKeyOK" ] ; then
- log info " * acceptable sub key."
+ log verbose " * acceptable sub key."
if [ -z "$sshKey" ] ; then
log error " ! sub key could not be translated (not RSA or DSA?)."
else
host="$1"
userID="ssh://${host}"
- log info "processing: $host"
+ log verbose "processing: $host"
nKeys=0
nKeysOK=0
# note if the known_hosts file was updated
if [ "$(file_hash "$KNOWN_HOSTS")" != "$fileCheck" ] ; then
- log info "known_hosts file updated."
+ log verbose "known_hosts file updated."
fi
# if an acceptable host was found, return 0
process_known_hosts() {
local hosts
- log info "processing known_hosts file..."
+ log verbose "processing known_hosts file..."
hosts=$(meat "$KNOWN_HOSTS" | cut -d ' ' -f 1 | grep -v '^|.*$' | tr , ' ' | tr '\n' ' ')
userID="$1"
- log info "processing: $userID"
+ log verbose "processing: $userID"
nKeys=0
nKeysOK=0
# note if the authorized_keys file was updated
if [ "$(file_hash "$AUTHORIZED_KEYS")" != "$fileCheck" ] ; then
- log info "authorized_keys file updated."
+ log verbose "authorized_keys file updated."
fi
# if an acceptable id was found, return 0
authorizedUserIDs="$1"
- log info "processing authorized_user_ids file..."
+ log verbose "processing authorized_user_ids file..."
if ! meat "$authorizedUserIDs" > /dev/null ; then
log error "no user IDs to process."
if [ -z "$1" ] ; then
# find all secret keys
- keyID=$(gpg --with-colons --list-secret-keys | grep ^sec | cut -f5 -d:)
+ keyID=$(gpg --with-colons --list-secret-keys | grep ^sec | cut -f5 -d: | sort -u)
# if multiple sec keys exist, fail
if (( $(echo "$keyID" | wc -l) > 1 )) ; then
echo "Multiple secret keys found:"
# fail if multiple sec lines are returned, which means the id
# given is not unique
- if [ $(echo "$gpgOut" | grep '^sec:' | wc -l) -gt '1' ] ; then
+ if [ $(echo "$gpgOut" | grep -c '^sec:') -gt '1' ] ; then
failure "Key ID '$keyID' is not unique."
fi
EOF
)
- log info "generating subkey..."
+ log verbose "generating subkey..."
fifoDir=$(mktemp -d)
(umask 077 && mkfifo "$fifoDir/pass")
echo "$editCommands" | gpg --passphrase-fd 3 3< "$fifoDir/pass" --expert --command-fd 0 --edit-key "$keyID" &
rm -rf "$fifoDir"
wait
- log info "done."
+ log verbose "done."
}
function subkey_to_ssh_agent() {
for uname in $unames ; do
# check all specified users exist
if ! getent passwd "$uname" >/dev/null ; then
- log info "----- unknown user '$uname' -----"
+ log error "----- unknown user '$uname' -----"
continue
fi
fi
fi
- log info "----- user: $uname -----"
+ log verbose "----- user: $uname -----"
# exit if the authorized_user_ids file is empty
if ! check_key_file_permissions "$uname" "$AUTHORIZED_USER_IDS" ; then
- log error "Improper permissions on authorized_user_ids file path."
+ log error "Improper permissions on path '$AUTHORIZED_USER_IDS'."
continue
fi
# check permissions on the authorized_keys file path
if ! check_key_file_permissions "$uname" "$RAW_AUTHORIZED_KEYS" ; then
- log error "Improper permissions on authorized_keys file path path."
+ log error "Improper permissions on path '$RAW_AUTHORIZED_KEYS'."
continue
fi
# add user-controlled authorized_keys file path if specified
if [ "$rawAuthorizedKeys" != '-' -a -s "$rawAuthorizedKeys" ] ; then
- log info "adding raw authorized_keys file... "
+ log verbose "adding raw authorized_keys file... "
cat "$rawAuthorizedKeys" >> "$AUTHORIZED_KEYS"
fi
EOF
)
- log info "generating server key..."
+ log verbose "generating server key..."
echo "$keyParameters" | gpg_host --batch --gen-key
# output the server fingerprint
fingerprint=$(fingerprint_server_key)
# export host ownertrust to authentication keyring
- log info "setting ultimate owner trust for server key..."
+ log verbose "setting ultimate owner trust for server key..."
echo "${fingerprint}:6:" | gpg_authentication "--import-ownertrust"
# translate the private key to ssh format, and export to a file
# established. Can be added to ~/.ssh/config as follows:
# ProxyCommand monkeysphere-ssh-proxycommand %h %p
-########################################################################
-SHARE=${MONKEYSPHERE_SHARE:-"/usr/share/monkeysphere"}
-. "${SHARE}/common" || exit 1
-
########################################################################
usage() {
HOST="$1"
PORT="$2"
-MS_HOME=${MS_HOME:-"${HOME}/.config/monkeysphere"}
-
if [ -z "$HOST" ] ; then
echo "Host not specified." >&2
usage
fi
URI="ssh://${HOSTP}"
+# specify keyserver checking. the behavior of this proxy command is
+# intentionally different than that of running monkeyesphere normally,
+# and keyserver checking is intentionally done under certain
+# circumstances. This can be overridden by setting the
+# MONKEYSPHERE_CHECK_KEYSERVER environment variable.
+
# if the host is in the gpg keyring...
if gpg --list-key ="${URI}" 2>&1 >/dev/null ; then
# do not check the keyserver
CHECK_KEYSERVER="true"
fi
fi
-
+# set and export the variable for use by monkeysphere
MONKEYSPHERE_CHECK_KEYSERVER=${MONKEYSPHERE_CHECK_KEYSERVER:="$CHECK_KEYSERVER"}
export MONKEYSPHERE_CHECK_KEYSERVER
[[meta title="Monkeysphere archive signing key"]]
-[[!template id="nav"]]
[[toc ]]
## Verifying the key ##
S31RCBx16I7tJya0fwJJRC7qZWf7hrPdi7eqcecqyr26X5upV+Irjv5qYu/6HAGb
59W6n+8KTfMxEMaBQI6qZXxhaBr3HzEaSrz7jtkl+xxym2TGkbarXcm7e7MP66Hu
GD5UCC3svhAAxKXf4K/8v7WhwBpekF9mXtgpq72Du2JG9q+OAWhxzZXbZku+RY7T
-a83wKc1TaPvzK2WZlhNGjcCYSUXcfQOSn5noVTUukW3DNEKP5BmwkvVd
-=Xex0
+a83wKc1TaPvzK2WZlhNGjcCYSUXcfQOSn5noVTUukW3DNEKP5BmwkvVdiEYEEBEC
+AAYFAki9wXQACgkQ9n4qXRzy1ioXYwCgmzCV+o+Ai0gNx0pt9shofcjfJoAAoInV
+mhn36lBeDh/E6cigrUlkdDGWiQIcBBABAgAGBQJIvdcSAAoJEO00zqvie6q8sB4Q
+AKDLTKqtiONf4FkMCZFcMxQyiALcy76zTW9L2oK90zKRhKSt5RPnVmDVyiinBcRJ
+h0lEkpxoqSrs+0XvASWC3RzWLEbW6XXsuHO1RXFsC3FNbe0HkHenirenFkitPMDX
+Q5gHmCJ6yiq2ssuzXAG9vZ4HjkUINBgkeMASiTRC7o0we7jFSRzOTCs4WWdsavrx
+7bhCadeC35ISldTSo6nOP3laPctPcLD83cJszzQyHr/LjF6KYr6n85NAwIt/oxHh
+EUxmezx+lMwWHdr9TQzXzU8cxLSBZ+c+PuZ/NuHz9fOv87eaFDNEqKli9zhzh4eA
+EMeiWKQXHYlmEUUWnZoea46jdjBrvHphogqlCjzMDHtg/pWOsYrGeXjjZ352SGN4
+vyinkdxwUppGQATz55WyiWIzCY1Kt7lqaQHfAM1NgVdoCQ0stlulIO4LVepHRiAY
+HO4EPeQO6pVGGHWCzJyEcMcaBsYGpr9DndSNd66O+Gyeq8QobKnvTH25kwVt/8t1
+9nS+7NLwBrqXCISeDrOQYq5XeCdvpAuJy4CEN5muQWRdUPekE2dh7qcVUdROepq0
+1wMemkmgTLlA0Md7ZdZqsllKhVQ7/HOFzshEaj/VcFrQshuIAjDZFN/OrGLX/NcL
+tcaBmD9lZSQ3CyxnBUTeMdJCOLOK050jNvsEsM89FL+g
+=bJWl
-----END PGP PUBLIC KEY BLOCK-----
</pre>
git clone git://git.monkeysphere.info/monkeysphere
cd monkeysphere
- git tag -v $TAG
- git checkout $TAG
+ git tag -v "$TAG"
+ git checkout "$TAG"
debuild -uc -us
cd repo
- reprepro -C monkeysphere include experimental ../$TAG_$ARCH.changes
+ reprepro -C monkeysphere include experimental "../$TAG_$ARCH.changes"
When you get a binary package built from a separate architecture
`$NEWARCH` that you want to include with the archive, do:
cd repo
- reprepro -C monkeysphere includedeb experimental ../$TAG_$NEWARCH.deb
+ reprepro -C monkeysphere includedeb experimental "../$TAG_$NEWARCH.deb"
To publish the archive, make sure you have access to
`archivemaster@george.riseup.net`, and then do:
-[[!template id="nav"]]
-[[meta title="Bugs"]]
+[[meta title="Open Bugs"]]
This is Monkeysphere's bug list. You can also browse our [completed bugs](done).
If you don't have commit access to the public repo, we'd appreciate
-[[!template id="nav"]]
+[[meta title="Completed Bugs"]]
Recently fixed [[bugs]].
-[[meta title="MonkeySphere needs to be able to cleanly export passphrase-locked secret keys from the GPG keyring"]]
+[[meta title="MonkeySphere can't deal with passphrase-locked primary keys"]]
At the moment, the only tool we have to export passphrase-locked
secret keys from the GPG keyring is `gpg` itself (and `gpg2`, which
Can this bug be closed? dkg [reported in a comment for a related
bug](/bugs/install-seckey2sshagent-in-usr-bin/):
- Version 0.11-1 now has the monkeysphere subkey-to-ssh-agent
- subcommand, which works cleanly in the presence of a
- functionally-patched GnuTLS.
+ Version 0.11-1 now has the monkeysphere subkey-to-ssh-agent
+ subcommand, which works cleanly in the presence of a
+ functionally-patched GnuTLS.
+
+--------
+
+Even with the patched GnuTLS, monkeysphere currently can't currently
+deal with passphrase-locked primary keys. I've changed the title of
+this bug, but i'd like to keep it open until we are able to deal with
+that. The other comments here seem still quite relevant to that
+need.
+
+I've changed the title of this bug to reflect the narrowed scope.
+
+ --dkg
gets pushed out.
-- BJ
+
+---
+
+I think this is [[/bugs/done]] as of version 0.12-1.
wants to handle that, that would be fine with me.
-- jgr
+
+---
+
+i'm not really willing to maintain anything extra either, so i'm
+closing this ticket as [[bugs/done]].
+
+--dkg
-[[!template id="nav"]]
-
[[meta title="Community"]]
## Mailing list ##
Micah Anderson:
git clone git://labs.riseup.net/~micah/monkeysphere
-
## Contact ##
Please feel free to contact any of the Monkeysphere developers or post
to the mailing list with questions, comments, bug reports, requests,
-etc.
+etc. If you contact a developer individually, please indicate if
+there is any part of your note that can be made public (we might want
+to post it to the web here).
-[[!template id="nav"]]
[[meta title="Documentation"]]
## Dependencies ##
-[[!template id="nav"]]
+[[meta title="Download"]]
## Downloading and Installing ##
by following these directions:
You can add this repo to your system by putting the following lines in
-/etc/apt/sources.list.d/monkeysphere.list:
+`/etc/apt/sources.list.d/monkeysphere.list`:
deb http://archive.monkeysphere.info/debian experimental monkeysphere
deb-src http://archive.monkeysphere.info/debian experimental monkeysphere
-[[!template id="nav"]]
+The Monkeysphere project's goal is to extend OpenPGP's web of trust to
+new areas of the Internet to help us securely identify each other
+while we work online.
-The Monkeysphere project's goal is to extend the web of trust model
-and other features of OpenPGP to other areas of the Internet to help
-us securely identify each other while we work online.
+Specifically, monkeysphere currently offers a framework to leverage
+the OpenPGP web of trust for OpenSSH authentication.
-Specifically, monkeysphere is a framework to leverage the OpenPGP web
-of trust for OpenSSH authentication. In other words, it allows you to
-use your OpenPGP keys when using secure shell to both identify
-yourself and the servers you administer or connect to. OpenPGP keys
-are tracked via GnuPG, and managed in the `known_hosts` and
-`authorized_keys` files used by OpenSSH for connection authentication.
+In other words, it allows you to use secure shell as you normally do,
+but to identify yourself and the servers you administer or connect to
+with your OpenPGP keys. OpenPGP keys are tracked via GnuPG, and
+monkeysphere manages the `known_hosts` and `authorized_keys` files
+used by OpenSSH for authentication, checking them for cryptographic
+validity.
-## Conceptual overview ##
+## Overview ##
Everyone who has used secure shell is familiar with the prompt given
the first time you log in to a new server, asking if you want to trust
[OpenPGP](http://en.wikipedia.org/wiki/Openpgp) [web of
trust](http://en.wikipedia.org/wiki/Web_of_trust).
-## Technical details ##
-
Under the Monkeysphere, both parties to an OpenSSH connection (client
and server) explicitly designate who they trust to certify the
identity of the other party. These trust designations are explicitly
to use raw RSA public keys), and no modification is needed to the
OpenSSH software.
-To emphasize: *no modifications to SSH are required to use the
-Monkeysphere*. OpenSSH can be used as is; completely unpatched and
+To emphasize: ***no modifications to SSH are required to use the
+Monkeysphere***. OpenSSH can be used as is; completely unpatched and
"out of the box".
-## Philosophy ##
-
-Humans (and
-[monkeys](http://www.scottmccloud.com/comics/mi/mi-17/mi-17.html))
-have the innate capacity to keep track of the identities of only a
-finite number of people. After our social sphere exceeds several dozen
-or several hundred (depending on the individual), our ability to
-remember and distinguish people begins to break down. In other words,
-at a certain point, we can't know for sure that the person we ran into
-in the produce aisle really is the same person who we met at the party
-last week.
-
-For most of us, this limitation has not posed much of a problem in our
-daily, off-line lives. With the Internet, however, we have an ability
-to interact with vastly larger numbers of people than we had
-before. In addition, on the Internet we lose many of our tricks for
-remembering and identifying people (physical characteristics, sound of
-the voice, etc.).
-
-Fortunately, with online communications we have easy access to tools
-that can help us navigate these problems.
-[OpenPGP](http://en.wikipedia.org/wiki/Openpgp) (a cryptographic
-protocol commonly used for sending signed and encrypted email
-messages) is one such tool. In its simplest form, it allows us to
-sign our communication in such a way that the recipient can verify the
-sender.
-
-OpenPGP goes beyond this simple use to implement a feature known as
-the [web of trust](http://en.wikipedia.org/wiki/Web_of_trust). The web
-of trust allows people who have never met in person to communicate
-with a reasonable degree of certainty that they are who they say they
-are. It works like this: Person A trusts Person B. Person B verifies
-Person C's identity. Then, Person A can verify Person C's identity
-because of their trust of Person B.
-
-The Monkeyshpere's broader goals are to extend the use of OpenPGP from
-email communications to other activities, such as:
-
- * conclusively identifying the remote server in a remote login session
- * granting access to servers to people we've never directly met
-
## Links ##
* [OpenSSH](http://openssh.com/)
h2 {
--moz-border-radius-topleft:4px;
--moz-border-radius-topright:4px;
-background-color:#B67B4E;
-color:black;
-display:block;
-font-weight:bold;
-padding:0 0 0 10px;
+ -moz-border-radius: 4px;
+ background-color: #B67B4E;
+ color: black;
+ display: block;
+ font-weight: bold;
+ padding: 0 0 0 10px;
}
body {
-color:#3F403F;
-font-family:"Liberation Sans",sans-serif;
-font-size:0.95em;
+ color: #3F403F;
+ font-family: "Liberation Sans",sans-serif;
+ font-size: 0.95em;
}
*|*:visited
-color:#f6a464;
+ color: #f6a464;
}
*|*:-moz-any-link {
-text-decoration:none;
+ text-decoration: none;
}
:-moz-any-link {
-cursor:pointer;
+ cursor: pointer;
}
a:link {
}
pre {
- background: #ddd;
- border: 1px solid #aaa;
- padding: 3px 3px 3px 3px;
- margin-left: 2em;
+ background: #ddd;
+ border: 1px solid #aaa;
+ padding: 3px 3px 3px 3px;
+ margin-left: 2em;
}
table.sitenav {
- border-bottom: 2px solid black;
- padding: 0px;
- width: 100%;
- font-size: larger;
+ border-bottom: 2px solid black;
+ padding: 0px;
+ width: 100%;
+ font-size: larger;
}
table.sitenav img.logo {
- margin: 0px;
- padding: 0px;
- vertical-align: bottom;
+ margin: 0px;
+ padding: 0px;
+ vertical-align: bottom;
}
table.sitenav a {
}
div.header {
- text-align: right;
+ text-align: right;
+ display: none;
}
div.actions {
- text-align: right;
+ text-align: right;
+ display: none;
+}
+
+#sidebar {
+ line-height: normal;
+ width: 100%;
+ float: none;
+ margin: 0;
+ padding: 0;
}
+
--- /dev/null
+[[meta title="Mirroring the web site"]]
+
+In keeping with the philosophy of distributed development, our web site is
+stored in our git repositories and converted into html by
+[ikiwiki](http://ikiwiki.info/).
+
+We're mirrored on several servers. Rather than using ikiwiki's [pinger/pingee
+approach to distribution](http://ikiwiki.info/tips/distributed_wikis/), we've
+opted for a method that uses ssh.
+
+The steps for creating a new mirror are:
+
+## Steps to take on the mirror server ##
+
+Add etch-backports to your /etc/apt/sources.list:
+
+ deb http://www.backports.org/debian etch-backports main contrib non-free
+
+Add the following lines to your /etc/apt/preferences file:
+
+ Package: ikiwiki
+ Pin: release a=etch-backports
+ Pin-Priority: 999
+
+ # needed by ikiwiki
+ Package: libcgi-formbuilder-perl
+ Pin: release a=etch-backports
+ Pin-Priority: 999
+
+ Package: git-core
+ Pin: release a=etch-backports
+ Pin-Priority: 999
+
+Install git-core and ikiwiki
+
+ aptitude update; aptitutde install git-core ikiwiki
+
+Create a new user. Change the new users shell to git-shell:
+
+ adduser -s /usr/bin/git-shell <username>
+
+Add webmaster@george's public key to this user's ~/.ssh/authorized_keys file
+
+Add web site configuration that the user has write access to. If you are using Apache, include the following rewrite:
+
+ RewriteEngine On
+ RewriteCond %{HTTP_HOST} !^(YOURHOSTNAME|web)\.monkeysphere\.info$ [NC]
+ RewriteCond %{HTTP_HOST} !^$
+ RewriteRule ^/(.*) http://web.monkeysphere.info/$1 [L,R]
+
+Upload and edit ikiwiki.setup.sample from the docs directory
+
+As the new user, create two new git repos
+
+ mkdir monkeysphere.git; cd monkeysphere.git; git init --bare; cd ../
+ git clone monkeysphere.git # this will create a second git repo called monkeysphere
+
+Change the mode of monkeysphere.git/hooks/post-receive to 755
+
+ chmod 755 monkesphere.git/hooks/post-receive
+
+Edit the file so that it executes the post-receive hook ikiwiki generates (as
+you specified in the ikiwiki.setup file)
+
+## Admin steps to take to enable the configuration ##
+
+Add a new dns record for SERVERNAME.monkeysphere.info.
+
+Test the ssh connection by logging in as webmaster@george.riseup.net
+
+Add the new server as a remote on webmaster@george.riseup.net:monkeysphere.git
+
+ cd ~/monkeysphere.git
+ git add remote SERVERNAME USER@SERVERNAME.monkeysphere.info:/path/to/repo
+
+Test:
+
+ git push SERVERNAME
+
+
+
-[[!template id="nav"]]
[[meta title="News"]]
Here are the latest announcements about the Monkeysphere.
`http://archive.monkeysphere.info/debian`. You'll probably want to
update your `sources.list` to match the [official lines](/download).
+The monkeysphere APT repository is also using [a new archive signing
+key](/archive-key):
+
+ pub 4096R/EB8AF314 2008-09-02 [expires: 2009-09-02]
+ Key fingerprint = 2E8D D26C 53F1 197D DF40 3E61 18E6 67F1 EB8A F314
+ uid [ full ] Monkeysphere Archive Signing Key (http://archive.monkeysphere.info/debian)
+
Apologies for any confusion or hassle this causes!
--- /dev/null
+[[meta title="MonkeySphere 0.12-1 released!"]]
+
+# MonkeySphere 0.12-1 released! #
+
+MonkeySphere 0.12-1 has been released. This release includes
+documentation updates, and a re-organized logging subsystem with
+various levels of verbosity, modeled after LogLevel in OpenSSH.
+
+[[download]] it now!
--- /dev/null
+<table class="sitenav" cellpadding="0" cellspacing="0">
+<tbody><tr><td>
+<a class="logo" href="/"><img class="logo" src="/logo.png" alt="monkeysphere" width="343" height="85" /></a>
+</td><td>
+
+[[WHY?|why]]
+[[DOWNLOAD|download]]
+[[DOCUMENTATION|doc]]
+[[NEWS|news]]
+[[COMMUNITY|community]]
+[[BUGS|bugs]]
+
+</td></tr></tbody></table>
-[[!template id="nav"]]
[[meta title="Similar Projects"]]
The monkeysphere isn't the only project intending to implement a PKI
+++ /dev/null
-<table class="sitenav" cellpadding="0" cellspacing="0">
-<tbody><tr><td>
-<a class="logo" href="/"><img class="logo" src="/logo.png" alt="monkeysphere" width="343" height="85" /></a>
-</td><td>
-
-[[WHY?|why]]
-[[DOWNLOAD|download]]
-[[DOCUMENTATION|doc]]
-[[NEWS|news]]
-[[COMMUNITY|community]]
-[[BUGS|bugs]]
-
-</td></tr></tbody></table>
--- /dev/null
+[[meta title
+You can see your trust database parameters like this:
+
+ gpg --with-colons --list-key bogusgarbagehere 2>/dev/null | head -n1
+
+for me, it looks like this:
+
+ tru::1:1220401097:1220465006:3:1:5
+
+These colon-delimited records say (in order):
+
+ * `tru`: this is a trust database record
+ * `<empty>`: the trust database is not stale (might be 'o' for old, or 't' for "built with different trust model and not yet updated")
+ * `1`: uses new "PGP" trust model: this is just the old trust model plus trust signatures. I'll go into trust signatures later.
+ * `1220401097`: seconds since the epoch that i created the trust db.
+ * `1220465006`: seconds after the epoch that the trustdb will need to be rechecked (usually due to the closest pending expiration, etc)
+ * `3`: Either 3 certifications from keys with marginal ownertrust are needed for full User ID+Key validity
+ * `1`: Or 1 certification from a key with full ownertrust is needed for full User ID+Key validity
+ * `5`: max_cert_depth (not sure exactly how this is used)
+
+
-[[!template id="nav"]]
-
[[meta title="Why should you be interested in the MonkeySphere?"]]
[[toc ]]
[Get started with the monkeysphere as a user!](/getting-started-user)
-## As an system administrator ##
+## As a system administrator ##
As a system administrator, have you ever tried to re-key an SSH
server? How did you communicate the key change to your users? How
actual humans using these tools than some message like "Certified by
GloboTrust".
+## Philosophy ##
+
+Humans (and
+[monkeys](http://www.scottmccloud.com/comics/mi/mi-17/mi-17.html))
+have the innate capacity to keep track of the identities of only a
+finite number of people. After our social sphere exceeds several dozen
+or several hundred (depending on the individual), our ability to
+remember and distinguish people begins to break down. In other words,
+at a certain point, we can't know for sure that the person we ran into
+in the produce aisle really is the same person who we met at the party
+last week.
+
+For most of us, this limitation has not posed much of a problem in our
+daily, off-line lives. With the Internet, however, we have an ability
+to interact with vastly larger numbers of people than we had
+before. In addition, on the Internet we lose many of our tricks for
+remembering and identifying people (physical characteristics, sound of
+the voice, etc.).
+
+Fortunately, with online communications we have easy access to tools
+that can help us navigate these problems.
+[OpenPGP](http://en.wikipedia.org/wiki/Openpgp) (a cryptographic
+protocol commonly used for sending signed and encrypted email
+messages) is one such tool. In its simplest form, it allows us to
+sign our communication in such a way that the recipient can verify the
+sender.
+
+OpenPGP goes beyond this simple use to implement a feature known as
+the [web of trust](http://en.wikipedia.org/wiki/Web_of_trust). The web
+of trust allows people who have never met in person to communicate
+with a reasonable degree of certainty that they are who they say they
+are. It works like this: Person A trusts Person B. Person B verifies
+Person C's identity. Then, Person A can verify Person C's identity
+because of their trust of Person B.
+
+The Monkeyshpere's broader goals are to extend the use of OpenPGP from
+email communications to other activities, such as:
+
+ * conclusively identifying the remote server in a remote login session
+ * granting access to servers to people we've never directly met
projects / monkeysphere.git / commitdiff