MONKEYSPHERE(7)

✨ MONKEYSPHERE ✨

ok so bestie, welcome to the monkeysphere manual page (that's section 7 of the manual, system frameworks girlie 💅). buckle up, we're talking ssh and TLS auth via the OpenPGP Web of Trust, and it's honestly iconic.

---

🌸 NAME 🌸

monkeysphere — an ssh and TLS authentication framework using OpenPGP Web of Trust. no cap, that's the whole vibe.

---

💖 DESCRIPTION 💖

okay so Monkeysphere is a framework that leverages the OpenPGP web of trust for OpenSSH and TLS key-based authentication. the way it works is: OpenPGP keys get tracked via GnuPG, and then they get added to the authorized_keys and known_hosts files that OpenSSH uses for connection authentication. literally so clean.

and bestie, it doesn't stop at ssh — Monkeysphere can also be used by a validation agent to validate TLS connections (like, say, https). 🦋

---

🎀 IDENTITY CERTIFIERS 🎀

so here's the situation. every host that uses the Monkeysphere to authenticate its remote users needs some way to determine that those users are who they claim to be. SSH does permit key-based authentication, but that's not what we want — we want to bind authenticators to human-comprehensible user identities instead. ✨

this switch from raw keys to User IDs does two big things:

• it makes it possible for administrators to see intuitively who has access to an account 👀
• it also enables end users to transition keys (and revoke compromised ones) automatically across all Monkeysphere-enabled hosts 🔥

the User IDs and certifications that the Monkeysphere relies on are found in the OpenPGP Web of Trust.

but hold on — to establish this binding, each host must know whose certifications to trust. someone who a host trusts to certify User Identities is called an Identity Certifier. a host needs at least one Identity Certifier in order to bind User IDs to keys. periodt.

commonly, every ID Certifier would be trusted by the host to fully identify any User ID — but more nuanced approaches are possible too, bestie. for example: a given host could specify a dozen ID certifiers, but assign them all "marginal" trust. then any given User ID would need to be certified in the OpenPGP Web of Trust by at least three of those certifiers. slay.

it's also possible to limit the scope of trust for a given ID Certifier to a particular domain. that is, a host can be configured to fully (or marginally) trust a particular ID Certifier only when they certify identities within, say, example.org (based on the e-mail address in the User ID). 🫶

---

💅 KEY ACCEPTABILITY 💅

the monkeysphere commands work from a set of user IDs to determine acceptable keys for ssh and TLS authentication. OpenPGP keys are considered acceptable if the following criteria are met:

capability

the key must have the authentication (a) usage flag set. ✅

validity

the key itself must be valid — i.e. it must be well-formed, not expired, and not revoked. 😭

certification

the relevant user ID must be signed by a trusted identity certifier. 🔏

---

🌈 HOST IDENTIFICATION 🌈

the OpenPGP keys for hosts have associated service names (OpenPGP user IDs) that are based on URI specifications for the service. some examples, bestie:

• ssh: — ssh://host.example.com[:port]
• https: — https://host.example.com[:port]

iykyk 💜

---

👑 AUTHOR 👑

written by: Jameson Rollins <jrollins@finestructure.net>, Daniel Kahn Gillmor <dkg@fifthhorseman.net>. absolute legends, fr fr.

---

🧚 SEE ALSO 🧚

• monkeysphere(1)
• monkeysphere-host(8)
• monkeysphere-authentication(8)
• openpgp2ssh(1)
• pem2openpgp(1)
• gpg(1)
• https://tools.ietf.org/html/rfc4880
• ssh(1)
• https://tools.ietf.org/wg/secsh/draft-ietf-secsh-scp-sftp-ssh-uri/

---

ok that's the whole page bestie 💖 this one's from the monkeysphere source, version stamped March 2010, and it lives in the MONKEYSPHERE(7) section of the manual. go forth and authenticate, main character 🎀✨🦋