summaryrefslogtreecommitdiff
path: root/website
diff options
context:
space:
mode:
authorJameson Graef Rollins <jrollins@finestructure.net>2008-12-10 11:05:53 -0500
committerJameson Graef Rollins <jrollins@finestructure.net>2008-12-10 11:05:53 -0500
commit2e55b0b407a4fc3438e0f546a57e011c81e26d81 (patch)
tree82dd8f046afedff03b3d3e862fedb404bb200ce8 /website
parentb9a98c7942c0f6b045a5bfa7c7ec4e40f1264e2d (diff)
some web updates:
- add new item about debian release - improve admin start documentation - add license note
Diffstat (limited to 'website')
-rw-r--r--website/doc.mdwn4
-rw-r--r--website/getting-started-admin.mdwn100
-rw-r--r--website/index.mdwn9
-rw-r--r--website/news/Monkeysphere-in-Debian.mdwn15
4 files changed, 95 insertions, 33 deletions
diff --git a/website/doc.mdwn b/website/doc.mdwn
index cd7bc76..28db2ef 100644
--- a/website/doc.mdwn
+++ b/website/doc.mdwn
@@ -19,10 +19,12 @@
## References ##
- * [Initial Monkeysphere specifications at CMRG](http://cmrg.fifthhorseman.net/wiki/OpenPGPandSSH)
+ * [OpenSSH](http://openssh.com/)
+ * [GnuPG](http://www.gnupg.org/)
* [OpenPGP (RFC 4880)](http://tools.ietf.org/html/rfc4880)
* [Secure Shell Authentication Protocol (RFC 4252)](http://tools.ietf.org/html/rfc4252)
* [URI scheme for SSH, RFC draft](http://tools.ietf.org/wg/secsh/draft-ietf-secsh-scp-sftp-ssh-uri/)
+ * [Initial Monkeysphere specifications at CMRG](http://cmrg.fifthhorseman.net/wiki/OpenPGPandSSH)
## Other ##
diff --git a/website/getting-started-admin.mdwn b/website/getting-started-admin.mdwn
index 1c373ac..5c7203d 100644
--- a/website/getting-started-admin.mdwn
+++ b/website/getting-started-admin.mdwn
@@ -2,60 +2,106 @@ Monkeysphere Server Administrator README
========================================
As the administrator of an SSH server, you can take advantage of the
-monkeysphere in two ways: you can publish the host key of your machine
-so that your users can have it automatically verified, and you can set
-up your machine to automatically identify connecting users by their
-presence in the OpenPGP web of trust.
+monkeysphere in two ways:
+1. you can publish the host key of your machine so that your users can
+have it automatically verified, and
+
+2. you can set up your machine to automatically identify connecting
+users by their presence in the OpenPGP web of trust.
+
+These things are not mutually required, and it is in fact possible to
+do one without the other. However, it is highly recommend that you at
+least do the first. Even if you decide that you do not want to use
+the monkeysphere to authenticate users to your system, you should at
+least the host key into the Web of Trust so that your users can be
+sure they're connecting to the correct machine.
+
+
+Monkeysphere for host verification
+==================================
Server host key publication
---------------------------
-To generate and publish a server host key:
+
+To begin, you must first generate a server host key:
# monkeysphere-server gen-key
- # monkeysphere-server publish-key
This will generate the key for server with the service URI
-(`ssh://server.example.net`). The server admin should now sign the
-server key so that people in the admin's web of trust can identify the
-server without manual host key checking:
+(`ssh://server.example.net`). Output the new key information with the
+'show-key' command:
+
+ # monkeysphere-server show-key
+
+Once the key has been generated, it needs to be publish to the Web of
+Trust:
+
+ # monkeysphere-server publish-key
+
+The server admin should now sign the server key so that people in the
+admin's web of trust can identify the server without manual host key
+checking. On your (the admin's) local machine retrieve the host key:
$ gpg --search '=ssh://server.example.net'
+
+Now sign the server key:
+
$ gpg --sign-key '=ssh://server.example.net'
+Make sure you compare the fingerprint of the retrieved with the one
+output with the 'show-key' command above, to verify you are signing
+the correct key. Finally, publish your signatures back to the
+keyservers:
+
+ $ gpg --send-key '=ssh://server.example.net'
Update OpenSSH configuration files
----------------------------------
To use the newly-generated host key for ssh connections, put the
-following line in `/etc/ssh/sshd_config` (be sure to remove references
-to any other keys):
+following line in `/etc/ssh/sshd_config` (be sure to comment out or
+remove any other HostKey references):
HostKey /var/lib/monkeysphere/ssh_host_rsa_key
-FIXME: should we just suggest symlinks in the filesystem here instead?
+FIXME: What about DSA host keys? The SSH RFC seems to require
+implementations support DSA, though OpenSSH will work without a DSA
+host key.
-FIXME: What about DSA host keys? The SSH RFC seems to require implementations support DSA, though OpenSSH will work without a DSA host key.
-To enable users to use the monkeysphere to authenticate using the
-OpenPGP web of trust, add this line to `/etc/ssh/sshd_config` (again,
-making sure that no other AuthorizedKeysFile directive exists):
+Monkeysphere for user authentication
+====================================
- AuthorizedKeysFile /var/lib/monkeysphere/authorized_keys/%u
+A host can maintain ssh `authorized_keys` files automatically for its
+users with the Monkeysphere. These `authorized_keys` files can then
+be used to enable users to use the monkeysphere to authenticate to
+your machine using the OpenPGP web of trust.
+
+Before this can happen, the host must first have a host key to use for
+user key verification. If you have not already generated a host key
+(as in the host verification instructions above), generate one now:
+
+ # monkeysphere-server gen-key
-And then read the section below about how to ensure these files are
-maintained. You'll need to restart `sshd` to have your changes take
-effect. As with any change to `sshd_config`, be sure to retain an
-existing session to the machine while you test your changes so you
-don't get locked out.
+Update OpenSSH configuration files
+----------------------------------
+
+SSH must be configured to point to the monkeysphere generated
+`authorized_keys` file. Add this line to `/etc/ssh/sshd_config`
+(again, making sure that no other AuthorizedKeysFile directive is left
+uncommented):
+ AuthorizedKeysFile /var/lib/monkeysphere/authorized_keys/%u
+
+You'll need to restart `sshd` to have your changes take effect. As
+with any change to `sshd_config`, be sure to retain an existing
+session to the machine while you test your changes so you don't get
+locked out.
Monkeysphere authorized_keys maintenance
----------------------------------------
-A host can maintain ssh authorized_keys files automatically for its
-users with the Monkeysphere.
-
For each user account on the server, the userids of people authorized
to log into that account would be placed in:
@@ -72,12 +118,12 @@ If the admin's OpenPGP keyid is `$GPGID`, then on the server run:
# monkeysphere-server add-identity-certifier $GPGID
-To update the monkeysphere authorized_keys file for user "bob" using
+To update the monkeysphere `authorized_keys` file for user "bob" using
the current set of identity certifiers, run:
# monkeysphere-server update-users bob
-To update the monkeysphere authorized_keys file for all users on the
+To update the monkeysphere `authorized_keys` file for all users on the
the system, run the same command with no arguments:
# monkeysphere-server update-users
diff --git a/website/index.mdwn b/website/index.mdwn
index 2e756ae..4abeea0 100644
--- a/website/index.mdwn
+++ b/website/index.mdwn
@@ -69,12 +69,11 @@ To emphasize: ***no modifications to SSH are required to use the
Monkeysphere***. OpenSSH can be used as is; completely unpatched and
"out of the box".
-## Links ##
+## License ##
-* [OpenSSH](http://openssh.com/)
-* [GnuPG](http://www.gnupg.org/)
-* [Secure Shell Authentication Protocol RFC 4252](http://tools.ietf.org/html/rfc4252)
-* [OpenPGP RFC 4880](http://tools.ietf.org/html/rfc4880)
+All Monkeysphere software is copyright, 2007, by [the
+authors](community), and released under [GPL, version 3 or
+later](http://www.gnu.org/licenses/gpl-3.0.html).
----
diff --git a/website/news/Monkeysphere-in-Debian.mdwn b/website/news/Monkeysphere-in-Debian.mdwn
new file mode 100644
index 0000000..acba904
--- /dev/null
+++ b/website/news/Monkeysphere-in-Debian.mdwn
@@ -0,0 +1,15 @@
+[[meta title="Monkeysphere now in Debian!"]]
+
+[The Monkeysphere has made it into
+Debian!](http://packages.debian.org/sid/monkeysphere)
+
+It is in Debian unstable (sid) now, which means it won't make it into
+the next unstable release (lenny), but hopefully will be in the stable
+release after that (squeeze).
+
+Congratulations to all the work by all the [monkeysphere
+developers](/community), and to Micah Anderson for being our Debian
+sponsor.
+
+Please feel free to start submitting bug reports to the [Debian
+BTS](http://bugs.debian.org/monkeysphere).