# $Id: README,v 1.13 2004/02/12 10:43:47 joostvb Exp $ See INSTALL for generic installation instructions. CONFIGURING CABOT After having installed, set up cabot. We'll show one way to do this (of course, there are more). - Create a useraccount "cabot". If you have the Debian adduser package installed, you can do this by running # adduser --system --home /usr/local/var/lib/cabot \ --shell /bin/false --group john --disabled-password \ --disabled-login --gecos "CA Bot" cabot where 'john' is your primary group. (Use # su -s /bin/sh - cabot to run a shell as the cabot user.) - Now, as the cabot user, create a file ~/.cabotrc: copy /usr/local/share/doc/cabot/examples/cabotrc and adjust it to your needs. See ca-config(5) for details about the file. You might want to use "cat" for the sendmail pipe, when testing your setup. Furthermore, under your own useraccount, having access to your private key, do you@yourhost ~$ ln -s ~cabot/.cabotrc so that, when running ca-dosign(1) under your own userid, you have a sane ~/.cabotrc. - Read cabot-micro-howto.txt, for hints on how to configure your mail setup to deal with cabot stuff. See the ca-bot pot file for usage info and more. Run ./configure && make ca-bot.txt to get it in a more readable format. HACKING ON CABOT Those who'd like to change the cabot internals, or want to build cabot from a fresh CVS tree, should refer to the file ./bootstrap . Public CVS read access is available from subversions.gnu.org:/cvsroot/cabot , see https://savannah.nongnu.org/cvs/?group=cabot . SIMILAR PROJECTS Other software automating keysigning tasks: - Skami (for "Sign key and mail it) : http://alioth.debian.org/projects/skami - Roland Mas's scripts, gpg-sync-keys (which allows you to get a key from a list of keyservers, or send it to them, or fetch all keys that have signed it), gpg-sign-and-check (which automates a bit of the long series of operations required to sign a key) and gpg-mail-signed-keys (which sends an email to all the people whose key you've signed on a particular date); see http://people.debian.org/~lolando/gpg-goodies/ . (Tnx Roland Mas for pointers.) SOME THOUGHTS Some tools sent a key, signed on just one uid, to this uid, in an encrypted message. These tools do not sent a challenge. These tools make sure only _this_ uid is signed, and therefore have to clear the keyring after each signing. For both the cabot way, and this way, there are arguments: Suppose we're signing a key with 7 uid's on it, with a typical user, who does request key upload. The cabot way: 8 emails are sent to the owner. The owner has to decrypt 7 messages, and reply 7 times. The user can optionally import her signed key sent to her keyring, sent in a last message. The other way: 7 emails are sent to the owner. The owner has to decrypt 7 messages, and upload 7 times (or import 7 times in her personal keyring, and upload once). (Tnx Erich Schubert for comments.) -- Joost van Baal