4

We have set up a local SKS keyserver in my company. It seems it is only possible to search keys (either for a name, email or keyid).

However, there are not so many users, so we would like to make the key repository browseable, that is being able to list all keys.

How would that be possible?

2 Answers 2

2

I gave up looking for this answer. I ended up writing a python script for this. It simply opens an http socket, send in this to the keyserver:

/pks/lookup?op=vindex&search=.com

which pulls down a listing of all the keys in the server. I then execute a findall on the email addresses, storing them in a set to weed out duplicates. Then I can loop through the email addresses, doing calls to the url

'/pks/lookup?op=vindex&search=%s&fingerprint=on&hash=on' % emailaddr

to get the fingerprints, ID, dates... whatever you want. I originally wrote the script to find duplicate email addresses and unused keys. I will likely mod the script to "preload" users keyring with all the keys in the keyserver automatically. After that, a simple call to gpg --refresh-keys should keep everybody happy.

3
  • 1
    It seems you're searching for .com which probably doesn't "pull down a listing of all the keys" but only those which email address contain .com I suppose. Apart from that, it would have been nice to give us your script rather than just talking about it.
    – Totor
    May 9, 2014 at 16:50
  • You're absolutely right, after some weeks, I discovered someone had snuck in a few .net addresses into the keyserver. I had to loop over several search strings, collecting all the results into a master list. it's kludgy, but functional. If I had some time, I'd write a script that runs on the server and dumps the contents of the database in one page. I'd love to share my code, but I can't. The company I work for owns that code, and they won't let me post it for free. Fortunately, they don't mind me talking about it at least. Jul 29, 2014 at 16:40
  • Ok, I guess the proper way is to change the SKS code to achieve that...
    – Totor
    Jul 31, 2014 at 8:26
0

The man page for sks doesn't look to have a list function of any sort. The only option that looks like it might give you what you want is dump.

dump #keys dumpdir
           Create a raw dump of the keys in the database.

References

2
  • The links in this response appear to be busted. I tried doing a dump. It appears to create some sort of database backup, that's in some binary format. The email addresses are in the dump file, but they're surrounded by other characters, and could be difficult to differentiate the chaff from the wheat. It would be more problematic to script an ssh session into the server, create and download the dump file, then cook it to get the list, but not impossible. Nov 10, 2017 at 0:22
  • @Therealstubot - updated the link, just the 2nd one wasn't working. To my knowledge the dump file is def. a binary file. If you look at the links to sks dump tools you can probably reverse the data structure that's ultimately in the dump file and determine a way to parse it.
    – slm
    Nov 10, 2017 at 1:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.