8 files changed, 251 insertions, 125 deletions

diff --git a/debian/control b/debian/control
index afd5bfa..d4d25c6 100644
--- a/debian/control
+++ b/debian/control
@@ -10,7 +10,7 @@ Dm-Upload-Allowed: yes
 
 Package: monkeysphere
 Architecture: any
-Depends: openssh-client, gnupg | gnupg2, coreutils (>= 6), ${shlibs:Depends}
+Depends: openssh-client, gnupg | gnupg2, coreutils (>= 6), moreutils, ${shlibs:Depends}
 Recommends: netcat
 Enhances: openssh-client, openssh-server
 Description: use the OpenPGP web of trust to verify ssh connections
diff --git a/debian/monkeysphere.dirs b/debian/monkeysphere.dirs
index fa2bf5f..4604eee 100644
--- a/debian/monkeysphere.dirs
+++ b/debian/monkeysphere.dirs
@@ -1,3 +1,4 @@
 usr/share/monkeysphere
 var/cache/monkeysphere
 etc/monkeysphere
+etc/monkeysphere/authorized_user_ids
diff --git a/man/man1/monkeysphere-ssh-proxycommand.1 b/man/man1/monkeysphere-ssh-proxycommand.1
index 41a95aa..63b5a5e 100644
--- a/man/man1/monkeysphere-ssh-proxycommand.1
+++ b/man/man1/monkeysphere-ssh-proxycommand.1
@@ -2,19 +2,32 @@
 .SH NAME
 monkeysphere-ssh-proxycommand \- MonkeySphere ssh ProxyCommand script
 .PD
-.SH SYNOPSIS
-.B ssh -o ProxyCommand="monkeysphere-ssh-proxycommand %h %p" ...
-.PD
 .SH DESCRIPTION
 .PP
-MonkeySphere is a system to leverage the OpenPGP Web of Trust for ssh
-authentication and encryption.  OpenPGP keys are tracked via GnuPG,
-and added to the ssh authorized_keys and known_hosts files to be used
-for authentication and encryption of ssh connection.
-
 \fBmonkeysphere-ssh-proxy\fP is an ssh proxy command that can be used
 to trigger a monkeysphere update of the known_hosts file for the hosts
-that are being connected to.
+that are being connected to.  It is meant to be run as an ssh
+ProxyCommand.  This can either be done by specifying the proxy command
+on the command line:
+
+.B ssh -o ProxyCommand="monkeysphere-ssh-proxycommand %h %p" ...
+
+or by adding the following line to your ~/.ssh/config script:
+
+.B ProxyCommand monkeysphere-ssh-proxycommand %h %p
+
+The script is very simple, and can easily be incorporated into other
+ProxyCommand scripts.  All it does is first runs
+
+.B monkeysphere update-known-hosts HOST
+
+and then
+
+.B exec nc HOST PORT
+
+Run the following command for more info:
+
+.B less $(which monkeysphere-ssh-proxycommand)
 .PD
 .SH AUTHOR
 Written by Jameson Rollins <jrollins@fifthhorseman.net>
diff --git a/man/man1/monkeysphere.1 b/man/man1/monkeysphere.1
index d00a9db..762f008 100644
--- a/man/man1/monkeysphere.1
+++ b/man/man1/monkeysphere.1
@@ -31,25 +31,32 @@ listed in the known_hosts file will be processed.  `k' may be used in
 place of `update-known_hosts'.
 .TP
 .B update-userids [USERID]...
-Add/update a userid in the authorized_user_ids file.  The user IDs
+Add/update a user ID to the authorized_user_ids file.  The user IDs
 specified should be exact matches to OpenPGP user IDs.  For each
 specified user ID, gpg will be queried for a key associated with that
 user ID, querying a keyserver if none is found in the user's keychain.
 If a key is found, it will be added to the user_keys cache (see KEY
 CACHES) and the user ID will be added to the user's
-authorized_user_ids file (if it wasn't already present).
+authorized_user_ids file (if it wasn't already present).  `u' may be
+used in place of `update-userids'.
+.TP
+.B remove-userids [USERID]...
+Remove a user ID from the authorized_user_ids file.  The user IDs
+specified should be exact matches to OpenPGP user IDs.  `r' may be
+used in place of `remove-userids'.
 .TP
 .B update-authorized_keys
 Update the monkeysphere authorized_keys file.  The monkeysphere
 authorized_keys file will be regenerated from the valid keys in the
 user_key cache, and the user's independently controlled
-authorized_keys file (usually ~/.ssh/authorized_keys).
+authorized_keys file (usually ~/.ssh/authorized_keys).  `a' may be
+used in place of `update-authorized_keys'.
 .TP
 .B gen-ae-subkey KEYID
 Generate an `ae` capable subkey.  For the primary key with the
 specified key ID, generate a subkey with "authentication" and
 "encryption" capability that can be used for MonkeySphere
-transactions.
+transactions.  `g' may be used in place of `gen-ae-subkey'.
 .TP
 .B help
 Output a brief usage summary.  `h' or `?' may be used in place of
diff --git a/man/man8/monkeysphere-server.8 b/man/man8/monkeysphere-server.8
index cc07077..8f62610 100644
--- a/man/man8/monkeysphere-server.8
+++ b/man/man8/monkeysphere-server.8
@@ -19,18 +19,27 @@ be used for authentication and encryption of ssh connection.
 Update the admin-controlled authorized_keys files for user.  For each
 user specified, update the user's authorized_keys file in
 /var/cache/monkeysphere/USER.  See `man monkeysphere' for more info.
+`k' may be used in place of `update-known_hosts'.
 .TP
 .B gen-key
-Generate a gpg key for the host.
+Generate a gpg key for the host.  `g' may be used in place of
+`gen-key'.
 .TP
 .B publish-key
-Publish the host's gpg key to a keyserver.
+Publish the host's gpg key to a keyserver.  `p' may be used in place
+of `publish-key'
 .TP
 .B trust-keys KEYID...
-Mark key specified with KEYID with full owner trust.
+Mark key specified with KEYID with full owner trust.  `t' may be used
+in place of `trust-keys'.
 .TP
 .B update-user-userids USER USERID...
-Add/update a userid in the authorized_user_ids file for USER.
+Add/update a user ID to the authorized_user_ids file for USER.  `u' may
+be used in place of `update-user-userids'.
+.TP
+.B remove-user-userids USER USERID...
+Remove a user ID from the authorized_user_ids file for USER.  `r' may
+be used in place of `remove-user-userids'.
 .TP
 .B help
 Output a brief usage summary.  `h' or `?' may be used in place of
diff --git a/src/common b/src/common
index 8b0f41a..01e6f32 100644
--- a/src/common
+++ b/src/common
@@ -23,14 +23,8 @@ failure() {
     exit ${2:-'1'}
 }
 
-# write output to stdout
-log() {
-    echo -n "ms: "
-    echo "$@"
-}
-
 # write output to stderr
-loge() {
+log() {
     echo -n "ms: " 1>&2
     echo "$@" 1>&2
 }
@@ -48,7 +42,7 @@ cutline() {
 # retrieve all keys with given user id from keyserver
 # FIXME: need to figure out how to retrieve all matching keys
 # (not just first 5)
-gpg_fetch_keys() {
+gpg_fetch_userid() {
     local id
     id="$1"
     echo 1,2,3,4,5 | \
@@ -75,6 +69,18 @@ check_capability() {
     return 0
 }
 
+# get the full fingerprint of a key ID
+get_key_fingerprint() {
+    local keyID
+
+    keyID="$1"
+
+    gpg --list-key --with-colons --fixed-list-mode \
+	--with-fingerprint "$keyID" | grep "$keyID" | \
+	grep '^fpr:' | cut -d: -f10
+}
+
+
 # convert escaped characters from gpg output back into original
 # character
 # FIXME: undo all escape character translation in with-colons gpg output
@@ -145,7 +151,7 @@ process_user_id() {
     requiredPubCapability=$(echo "$REQUIRED_KEY_CAPABILITY" | tr "[:lower:]" "[:upper:]")
 
     # fetch keys from keyserver, return 1 if none found
-    gpg_fetch_keys "$userID" || return 1
+    gpg_fetch_userid "$userID" || return 1
 
     # output gpg info for (exact) userid and store
     gpgOut=$(gpg --fixed-list-mode --list-key --with-colons \
@@ -153,7 +159,7 @@ process_user_id() {
 
     # return 1 if there only "tru" lines are output from gpg
     if [ -z "$(echo "$gpgOut" | grep -v '^tru:')" ] ; then
-	loge "  key not found."
+	log "  key not found."
 	return 1
     fi
 
@@ -182,18 +188,18 @@ process_user_id() {
 
 		# check primary key validity
 		if [ "$validity" != 'u' -a "$validity" != 'f' ] ; then
-		    loge "  unacceptable primary key validity ($validity)."
+		    log "  unacceptable primary key validity ($validity)."
 		    continue
 		fi
 		# check capability is not Disabled...
 		if check_capability "$capability" 'D' ; then
-		    loge "  key disabled."
+		    log "  key disabled."
 		    continue
 		fi
 		# check overall key capability
 		# must be Encryption and Authentication
 		if ! check_capability "$capability" $requiredPubCapability ; then
-		    loge "  unacceptable primary key capability ($capability)."
+		    log "  unacceptable primary key capability ($capability)."
 		    continue
 		fi
 
@@ -234,6 +240,9 @@ process_user_id() {
     # hash userid for cache file name
     userIDHash=$(echo "$userID" | sha1sum | awk '{ print $1 }')
 
+    # make sure the cache directory exists
+    mkdir -p "$cacheDir"
+
     # touch/clear key cache file
     # (will be left empty if there are noacceptable keys)
     > "$cacheDir"/"$userIDHash"."$pubKeyID"
@@ -242,7 +251,7 @@ process_user_id() {
     # key cache file
     if [ "$keyOK" -a "$uidOK" -a "${keyIDs[*]}" ] ; then
 	for keyID in ${keyIDs[@]} ; do
-	    loge "  acceptable key/uid found."
+	    log "  acceptable key/uid found."
 
 	    if [ "$MODE" = 'known_hosts' ] ; then
 		# export the key
@@ -267,6 +276,54 @@ process_user_id() {
     echo "$cacheDir"/"$userIDHash"."$pubKeyID"
 }
 
+# update the cache for userid, and prompt to add file to
+# authorized_user_ids file if the userid is found in gpg
+# and not already in file.
+update_userid() {
+    local userID
+    local cacheDir
+    local userIDKeyCache
+
+    userID="$1"
+    cacheDir="$2"
+
+    log "processing userid: '$userID'"
+
+    userIDKeyCache=$(process_user_id "$userID" "$cacheDir")
+
+    if [ -z "$userIDKeyCache" ] ; then
+	return 1
+    fi
+    if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then
+	read -p "user ID not currently authorized.  authorize? [Y|n]: " OK; OK=${OK:=Y}
+	if [ ${OK/y/Y} = 'Y' ] ; then
+	    log -n "adding user ID to authorized_user_ids file... "
+	    echo "$userID" >> "$AUTHORIZED_USER_IDS"
+	    echo "done."
+	else
+	    log "authorized_user_ids file untouched."
+	fi
+    fi
+}
+
+# remove a userid from the authorized_user_ids file
+remove_userid() {
+    local userID
+
+    userID="$1"
+
+    log "processing userid: '$userID'"
+
+    if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then
+	log "user ID not currently authorized."
+	return 1
+    fi
+
+    log -n "removing user ID '$userID'... "
+    grep -v "$userID" "$AUTHORIZED_USER_IDS" | sponge "$AUTHORIZED_USER_IDS"
+    echo "done."
+}
+
 # process a host for addition to a known_host file
 process_host() {
     local host
@@ -298,11 +355,11 @@ process_known_hosts() {
     cacheDir="$2"
 
     # take all the hosts from the known_hosts file (first field),
-    # grep out all the hashed hosts (lines starting with '|')
+    # grep out all the hashed hosts (lines starting with '|')...
     cut -d ' ' -f 1 "$knownHosts" | \
     grep -v '^|.*$' | \
     while IFS=, read -r -a hosts ; do
-	# process each host
+	# ...and process each host
 	for host in ${hosts[*]} ; do
 	    process_host "$host" "$cacheDir"
 	done
@@ -337,7 +394,8 @@ update_authorized_keys() {
 	cat "$userAuthorizedKeys" >> "$msAuthorizedKeys"
 	echo "done."
     fi
-    log "monkeysphere authorized_keys file generated: $msAuthorizedKeys"
+    log "monkeysphere authorized_keys file generated:"
+    log "$msAuthorizedKeys"
 }
 
 # process an authorized_*_ids file
@@ -398,42 +456,38 @@ process_userids_from_authorized_keys() {
     done
 }
 
-# update the cache for userid, and prompt to add file to
-# authorized_user_ids file if the userid is found in gpg
-# and not already in file.
-update_userid() {
-    local userID
-    local cacheDir
-    local userIDKeyCache
-
-    userID="$1"
-    cacheDir="$2"
-
-    log "processing userid: '$userID'"
-    userIDKeyCache=$(process_user_id "$userID" "$cacheDir")
-    if [ -z "$userIDKeyCache" ] ; then
-	return 1
-    fi
-    if ! grep -q "^${userID}\$" "$AUTHORIZED_USER_IDS" ; then
-	echo "the following userid is not in the authorized_user_ids file:"
-	echo "  $userID"
-	read -p "would you like to add? [Y|n]: " OK; OK=${OK:=Y}
-	if [ ${OK/y/Y} = 'Y' ] ; then
-	    log -n "  adding userid to authorized_user_ids file... "
-	    echo "$userID" >> "$AUTHORIZED_USER_IDS"
-	    echo "done."
-	fi
-    fi
-}
-
 # retrieve key from web of trust, and set owner trust to "full"
 # if key is found.
 trust_key() {
     # get the key from the key server
-    gpg --keyserver "$KEYSERVER" --recv-key "$keyID" || failure "could not retrieve key '$keyID'"
+    if ! gpg --keyserver "$KEYSERVER" --recv-key "$keyID" ; then
+	log "could not retrieve key '$keyID'"
+	return 1
+    fi
+
+    # get key fingerprint
+    fingerprint=$(get_key_fingerprint "$keyID")
+
+    # import "full" trust for fingerprint into gpg
+    echo ${fingerprint}:5: | gpg --import-ownertrust
+    if [ $? = 0 ] ; then
+	log "owner trust updated."
+    else
+	failure "there was a problem changing owner trust."
+    fi	
+}
+
+# publish server key to keyserver
+publish_server_key() {
+    read -p "really publish key to $KEYSERVER? [y|N]: " OK; OK=${OK:=N}
+    if [ ${OK/y/Y} != 'Y' ] ; then
+	failure "aborting."
+    fi
 
-    # edit the key to change trust
-    # FIXME: need to figure out how to automate this,
-    # in a batch mode or something.
-    gpg --edit-key "$keyID"
+    # publish host key
+    # FIXME: need to figure out better way to identify host key
+    # dummy command so as not to publish fakes keys during testing
+    # eventually:
+    #gpg --send-keys --keyserver "$KEYSERVER" $(hostname -f)
+    echo "NOT PUBLISHED: gpg --send-keys --keyserver $KEYSERVER $(hostname -f)"
 }
diff --git a/src/monkeysphere b/src/monkeysphere
index 6e71765..1ba51d7 100755
--- a/src/monkeysphere
+++ b/src/monkeysphere
@@ -15,7 +15,7 @@ SHAREDIR=${SHAREDIR:-"/usr/share/monkeysphere"}
 export SHAREDIR
 . "${SHAREDIR}/common"
 
-GLOBAL_CONFIG=${GLOBAL_CONFIG:-"${ETC}"/monkeysphere.conf}
+GLOBAL_CONFIG=${GLOBAL_CONFIG:-"${ETC}/monkeysphere.conf"}
 [ -r "$GLOBAL_CONFIG" ] && . "$GLOBAL_CONFIG"
 
 # date in UTF format if needed
@@ -31,11 +31,12 @@ GREP_OPTIONS=
 usage() {
 cat <<EOF
 usage: $PGRM <subcommand> [args]
-Monkeysphere client tool.
+MonkeySphere client tool.
 
 subcommands:
   update-known_hosts (k) [HOST]...  update known_hosts file
-  update-userids (u) [USERID]...    add/update userid
+  update-userids (u) [USERID]...    add/update user IDs
+  remove-userids (r) [USERID]...    remove user IDs
   update-authorized_keys (a)        update authorized_keys file
   gen-ae-subkey (g) KEYID           generate an 'ae' capable subkey
   help (h,?)                        this help
@@ -63,7 +64,7 @@ gen_ae_subkey(){
 
     # return 1 if there only "tru" lines are output from gpg
     if [ -z "$(echo "$gpgOut" | grep -v '^tru:')" ] ; then
-	loge "  key not found."
+	log "  key not found."
 	return 1
     fi
 
@@ -78,7 +79,7 @@ Name-Real: $userID
 EOF
 )
 
-    log "The following key parameters will be used:"
+    echo "The following key parameters will be used:"
     echo "$keyParameters"
 
     read -p "generate key? [Y|n]: " OK; OK=${OK:=Y}
@@ -107,27 +108,27 @@ COMMAND="$1"
 shift
 
 # set ms home directory
-MS_HOME=${MS_HOME:-"$HOME"/.config/monkeysphere}
+MS_HOME=${MS_HOME:-"${HOME}/.config/monkeysphere"}
 
 # load configuration file
-MS_CONF=${MS_CONF:-"$MS_HOME"/monkeysphere.conf}
+MS_CONF=${MS_CONF:-"${MS_HOME}/monkeysphere.conf"}
 [ -e "$MS_CONF" ] && . "$MS_CONF"
 
 # set empty config variable with defaults
-AUTHORIZED_USER_IDS=${AUTHORIZED_USER_IDS:-"$MS_HOME"/authorized_user_ids}
-GNUPGHOME=${GNUPGHOME:-"$HOME"/.gnupg}
-KEYSERVER=${KEYSERVER:-subkeys.pgp.net}
+AUTHORIZED_USER_IDS=${AUTHORIZED_USER_IDS:-"${MS_HOME}/authorized_user_ids"}
+GNUPGHOME=${GNUPGHOME:-"${HOME}/.gnupg"}
+KEYSERVER=${KEYSERVER:-"subkeys.pgp.net"}
 REQUIRED_KEY_CAPABILITY=${REQUIRED_KEY_CAPABILITY:-"e a"}
-USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-%h/.ssh/authorized_keys}
-USER_KNOWN_HOSTS=${USER_KNOWN_HOSTS:-"$HOME"/.ssh/known_hosts}
-HASH_KNOWN_HOSTS=${HASH_KNOWN_HOSTS:-}
+USER_CONTROLLED_AUTHORIZED_KEYS=${USER_CONTROLLED_AUTHORIZED_KEYS:-"%h/.ssh/authorized_keys"}
+USER_KNOWN_HOSTS=${USER_KNOWN_HOSTS:-"${HOME}/.ssh/known_hosts"}
+HASH_KNOWN_HOSTS=${HASH_KNOWN_HOSTS:-"true"}
 
 export GNUPGHOME
 
 # stagging locations
-hostKeysCacheDir="$MS_HOME"/host_keys
-userKeysCacheDir="$MS_HOME"/user_keys
-msAuthorizedKeys="$MS_HOME"/authorized_keys
+hostKeysCacheDir="${MS_HOME}/host_keys"
+userKeysCacheDir="${MS_HOME}/user_keys"
+msAuthorizedKeys="${MS_HOME}/authorized_keys"
 
 # make sure gpg home exists with proper permissions
 mkdir -p -m 0700 "$GNUPGHOME"
@@ -136,12 +137,14 @@ mkdir -p -m 0700 "$GNUPGHOME"
 mkdir -p -m 0700 "$MS_HOME"
 mkdir -p "$hostKeysCacheDir"
 mkdir -p "$userKeysCacheDir"
+touch "$AUTHORIZED_USER_IDS"
 
 case $COMMAND in
     'update-known_hosts'|'update-known-hosts'|'k')
 	MODE='known_hosts'
 
         # touch the known_hosts file to make sure it exists
+	# ssh-keygen complains if it doesn't exist
 	touch "$USER_KNOWN_HOSTS"
 
         # if hosts are specified on the command line, process just
@@ -151,8 +154,8 @@ case $COMMAND in
 		process_host "$host" "$hostKeysCacheDir"
 	    done
 
-        # otherwise, if no hosts are specified, process the user
-        # known_hosts file
+        # otherwise, if no hosts are specified, process every user
+        # in the user's known_hosts file
 	else
 	    if [ ! -s "$USER_KNOWN_HOSTS" ] ; then
 		failure "known_hosts file '$USER_KNOWN_HOSTS' is empty."
@@ -162,13 +165,34 @@ case $COMMAND in
 	fi
 	;;
 
+    'update-userids'|'update-userid'|'u')
+	if [ -z "$1" ] ; then
+	    failure "you must specify at least one userid."
+	fi
+	for userID ; do
+	    update_userid "$userID" "$userKeysCacheDir"
+	done
+	log "run the following to update your monkeysphere authorized_keys file:"
+	log "$PGRM update-authorized_keys"
+	;;
+
+    'remove-userids'|'remove-userid'|'r')
+	if [ -z "$1" ] ; then
+	    failure "you must specify at least one userid."
+	fi
+	for userID ; do
+	    remove_userid "$userID"
+	done
+	log "run the following to update your monkeysphere authorized_keys file:"
+	log "$PGRM update-authorized_keys"
+	;;
+
     'update-authorized_keys'|'update-authorized-keys'|'a')
 	MODE='authorized_keys'
 
-        # make sure authorized_user_ids file exists
+        # fail if the authorized_user_ids file is empty
 	if [ ! -s "$AUTHORIZED_USER_IDS" ] ; then
-	    log "authorized_user_ids file is empty or does not exist."
-	    exit
+	    failure "$AUTHORIZED_USER_IDS is empty."
 	fi
 
 	# set user-controlled authorized_keys file path
@@ -178,15 +202,6 @@ case $COMMAND in
 	update_authorized_keys "$msAuthorizedKeys" "$userAuthorizedKeys" "$userKeysCacheDir"
 	;;
 
-    'update-userids'|'u')
-	if [ -z "$1" ] ; then
-	    failure "you must specify at least one userid."
-	fi
-	for userID ; do
-	    update_userid "$userID" "$userKeysCacheDir"
-	done
-	;;
-
     'gen-ae-subkey'|'g')
 	keyID="$1"
 	if [ -z "$keyID" ] ; then
@@ -201,6 +216,6 @@ case $COMMAND in
 
     *)
         failure "Unknown command: '$COMMAND'
-Type 'cereal-admin help' for usage."
+Type '$PGRM help' for usage."
         ;;
 esac
diff --git a/src/monkeysphere-server b/src/monkeysphere-server
index 0ff06af..13221c5 100755
--- a/src/monkeysphere-server
+++ b/src/monkeysphere-server
@@ -28,14 +28,15 @@ GREP_OPTIONS=
 usage() {
 cat <<EOF
 usage: $PGRM <subcommand> [args]
-Monkeysphere server admin tool.
+MonkeySphere server admin tool.
 
 subcommands:
   update-users (s) [USER]...            update users authorized_keys files
   gen-key (g)                           generate gpg key for the server
   publish-key (p)                       publish server key to keyserver
   trust-keys (t) KEYID...               mark keyids as trusted
-  update-user-userids (u) USER UID...   add/update userids for a user
+  update-user-userids (u) USER UID...   add/update user IDs for a user
+  remove-user-userids (r) USER UID...   remove user IDs for a user
   help (h,?)                            this help
 
 EOF
@@ -70,7 +71,7 @@ EOF
 )
     fi
 
-    log "The following key parameters will be used:"
+    echo "The following key parameters will be used:"
     echo "$keyParameters"
 
     read -p "generate key? [Y|n]: " OK; OK=${OK:=Y}
@@ -90,25 +91,10 @@ EOF
 EOF
 )
 
-    echo "generating server key..."
+    log "generating server key..."
     echo "$keyParameters" | gpg --batch --gen-key
 }
 
-# publish server key to keyserver
-publish_key() {
-    read -p "publish key to $KEYSERVER? [Y|n]: " OK; OK=${OK:=Y}
-    if [ ${OK/y/Y} != 'Y' ] ; then
-	failure "aborting."
-    fi
-
-    keyID=$(gpg --list-key --with-colons ="$USERID" 2> /dev/null | grep '^pub:' | cut -d: -f5)
-
-    # dummy command so as not to publish fakes keys during testing
-    # eventually:
-    #gpg --send-keys --keyserver "$KEYSERVER" "$keyID"
-    echo "NOT PUBLISHED: gpg --send-keys --keyserver $KEYSERVER $keyID"
-}
-
 ########################################################################
 # MAIN
 ########################################################################
@@ -136,7 +122,7 @@ export GNUPGHOME
 mkdir -p -m 0700 "$GNUPGHOME"
 
 case $COMMAND in
-    'update-users'|'s')
+    'update-users'|'update-user'|'s')
 	if [ "$1" ] ; then
 	    unames="$@"
 	else
@@ -148,13 +134,17 @@ case $COMMAND in
 
 	    log "----- user: $uname -----"
 
+	    # set variables for the user
 	    AUTHORIZED_USER_IDS="$MS_HOME"/authorized_user_ids/"$uname"
 	    msAuthorizedKeys="$CACHE"/"$uname"/authorized_keys
 	    cacheDir="$CACHE"/"$uname"/user_keys
 
-            # make sure authorized_user_ids file exists
+            # make sure user's authorized_user_ids file exists
+	    touch "$AUTHORIZED_USER_IDS"
+
+	    # skip if the user's authorized_user_ids file is empty
 	    if [ ! -s "$AUTHORIZED_USER_IDS" ] ; then
-		log "authorized_user_ids file for '$uname' is empty or does not exist."
+		log "authorized_user_ids file for '$uname' is empty."
 		continue
 	    fi
 
@@ -176,19 +166,21 @@ case $COMMAND in
 	;;
 
     'publish-key'|'p')
-	publish_key
+	publish_server_key
 	;;
 
-    'trust-keys'|'t')
+    'trust-keys'|'trust-key'|'t')
 	if [ -z "$1" ] ; then
 	    failure "you must specify at least one key to trust."
 	fi
+
+	# process key IDs
 	for keyID ; do
 	    trust_key "$keyID"
 	done
 	;;
 
-    'update-user-userids'|'u')
+    'update-user-userids'|'update-user-userid'|'u')
 	uname="$1"
 	shift
 	if [ -z "$uname" ] ; then
@@ -197,11 +189,46 @@ case $COMMAND in
 	if [ -z "$1" ] ; then
 	    failure "you must specify at least one userid."
 	fi
+
+	# set variables for the user
 	AUTHORIZED_USER_IDS="$MS_HOME"/authorized_user_ids/"$uname"
 	cacheDir="$CACHE"/"$uname"/user_keys
+
+        # make sure user's authorized_user_ids file exists
+	touch "$AUTHORIZED_USER_IDS"
+
+	# process the user IDs
 	for userID ; do
 	    update_userid "$userID" "$cacheDir"
 	done
+
+	log "run the following to update user's authorized_keys file:"
+	log "$PGRM update-users $uname"
+	;;
+
+    'remove-user-userids'|'remove-user-userid'|'r')
+	uname="$1"
+	shift
+	if [ -z "$uname" ] ; then
+	    failure "you must specify user."
+	fi
+	if [ -z "$1" ] ; then
+	    failure "you must specify at least one userid."
+	fi
+
+	# set variables for the user
+	AUTHORIZED_USER_IDS="$MS_HOME"/authorized_user_ids/"$uname"
+
+        # make sure user's authorized_user_ids file exists
+	touch "$AUTHORIZED_USER_IDS"
+
+	# process the user IDs
+	for userID ; do
+	    remove_userid "$userID"
+	done
+
+	log "run the following to update user's authorized_keys file:"
+	log "$PGRM update-users $uname"
 	;;
 
     'help'|'h'|'?')
@@ -210,6 +237,6 @@ case $COMMAND in
 
     *)
         failure "Unknown command: '$COMMAND'
-Type 'cereal-admin help' for usage."
+Type '$PGRM help' for usage."
         ;;
 esac