From mboxrd@z Thu Jan  1 00:00:00 1970
Date: Thu,  8 May 2008 21:31:14 -0400
From: Nathaniel W Filardo <nwf@cs.jhu.edu>
To: Fans of the OS Plan 9 from Bell Labs <9fans@9fans.net>
Message-ID: <20080509013114.GA4503@peregrine.cs.jhu.edu>
References: <20080506203813.GR4503@peregrine.cs.jhu.edu>
	<20080508140604.1951A1E8C55@holo.morphisms.net>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="F4Dl6XKrV7PH8SJF"
Content-Disposition: inline
In-Reply-To: <20080508140604.1951A1E8C55@holo.morphisms.net>
User-Agent: Mutt/1.4i
Subject: Re: [9fans] infauth factotum bug?
Topicbox-Message-UUID: a3b0e526-ead3-11e9-9d60-3106f5b1d025


--F4Dl6XKrV7PH8SJF
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, May 08, 2008 at 10:02:18AM -0400, Russ Cox wrote:
> > term% echo delkey > /mnt/factotum/ctl
> > term% cpu -h sea.cs.jhu.edu -k 'user=3Dbootes'
> > [add key dance]
> > sea#
> > term% cpu -h sea.cs.jhu.edu -k 'user=3Dnwf'
> > [no key dance is necessary]
> > cpu%
> > term% cpu -h sea.cs.jhu.edu -k 'user=3Dme'
> > !Adding key: dom=3Dacm.jhu.edu proto=3Dp9sk1 user=3Dme
> > [I don't know me@'s password, so I abort by pressing Del.]
>=20
> > My username on my terminal is nwf.
>=20
> > The question is: why don't I have to present a password=20
> > to log in as nwf@ after I have logged in as bootes? =20
>=20
> Because bootes is the remote host owner.
> If factotum knows that key, it will use it to
> vouch for you.  This is why you can still mount
> things from a cpu server that you connected
> to using ssh or cron or rx or any other=20
> non-factotum-supplying method.

OK, so how does my factotum know that bootes is the remote host owner, or
does it just try to authenticate with that key despite that it doesn't match
the keyspec user=3Dnwf and see what happens?

> > Why doesn't this explanation hold for me@?
>=20
> Your user name on the terminal is nwf.
> Factotum will vouch for you, not lie for you.

OK.  This is, to me, counterintuitive behavior; if I have sufficient
credentials it's not really "lying".  It seems bizarre that factotum would
volunteer my terminal's user id, which is totally disjoint from the
user id namespace of the cpu server.

> All that said, the first cpu should not be adding
> the bootes key for use in the speakfor role:
> it should be adding it with role=3Dclient only,
> and then factotum won't use it to authenticate
> as nwf.  I thought it already did that.  Please
> send the output of cat /mnt/factotum/ctl after
> the above sequence.  Thanks.

I may be out of date, let me replica/pull and get back to you.

> Russ

Thanks for your answers.
--nwf;

--F4Dl6XKrV7PH8SJF
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (SunOS)

iD8DBQFII6liTeQabvr9Tc8RAr/8AJ9rWfYWTerWsTGLVA6uD//2rbPYzgCfc7qp
0YL1qvIAMi1xjmSoXSF6U2s=
=JQqG
-----END PGP SIGNATURE-----

--F4Dl6XKrV7PH8SJF--