9fans - fans of the OS Plan 9 from Bell Labs
 help / color / mirror / Atom feed
* [9fans] Re: Fun with sshsession
@ 2022-12-09  0:06 Steven Stallion
  2022-12-19 22:27 ` Brian L. Stuart
  0 siblings, 1 reply; 6+ messages in thread
From: Steven Stallion @ 2022-12-09  0:06 UTC (permalink / raw)
  To: 9fans

[-- Attachment #1: Type: text/plain, Size: 842 bytes --]

> I found another interesting wrinkle.  It appears this issue seems to
> only affect diskless CPU servers.  I'm able to SSH successfully to my
> auth and file servers.

Mystery solved!  It turns out this was the same issue Cinap fixed in
auth/as last year.  sshsession was inheriting the host owner factotum
after capuse, which was leading to breakage on hosts other than the
file server.

I've attached (and submitted to 9legacy) a patch to address the issue
in the Labs implementation.  To wit, I was able to duplicate this
issue on every implementation of SSH v2 that's available.

Cheers,
Steve

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/Ta343100f1654631e-M32b0c9ee1d3d680c6ba88ca5
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

[-- Attachment #2: ssh2-factotum.diff --]
[-- Type: text/plain, Size: 1167 bytes --]

This patch corrects non-host owner filesystem permissions in
sshsession.  Prior to these changes, SSH sessions would inherit the
host owner factotum, which lead to incorrect permissions on hosts
other than the file server.

These changes are similar to those submitted by Cinap Lenrek to
address a related issue in auth/as:

https://git.9front.org/plan9front/plan9front/55a0abdd439964793a5ebceb23776d162a0436d2/patch

--- /n/sources/plan9/sys/src/cmd/ssh2/sshsession.c	Sun May  6 14:55:41 2012
+++ /sys/src/cmd/ssh2/sshsession.c	Thu Dec  8 17:14:10 2022
@@ -89,6 +89,27 @@
 }
 
 /*
+ * mount factotum after auth
+ */
+static void
+mountfactotum(int ctlfd)
+{
+	int fd;
+
+	fd = open("/srv/factotum", ORDWR);
+	if (fd < 0) {
+		syslog(0, "ssh", "can't open /srv/factotum: %r");
+		hangup(ctlfd);
+		exits("open");
+	}
+	if (mount(fd, -1, "/mnt", MREPL, "") < 0) {
+		syslog(0, "ssh", "can't mount /srv/factotum in /mnt: %r");
+		hangup(ctlfd);
+		exits("can't mount");
+	}
+}
+
+/*
  * mount tunnel if there isn't one visible.
  */
 static void
@@ -135,6 +156,7 @@
 		return 0;
 
 	auth(buf, n, ctlfd);
+	mountfactotum(ctlfd);
 
 	p = strchr(buf, '@');
 	if (p == nil)

^ permalink raw reply	[flat|nested] 6+ messages in thread
* [9fans] Re: Fun with sshsession
@ 2022-12-07 17:36 Steven Stallion
  2022-12-07 18:39 ` michaelian ennis
  0 siblings, 1 reply; 6+ messages in thread
From: Steven Stallion @ 2022-12-07 17:36 UTC (permalink / raw)
  To: 9fans

> Has anyone on the list gotten sshsession up and running supporting
> non-host owner logins?

I found another interesting wrinkle.  It appears this issue seems to
only affect diskless CPU servers.  I'm able to SSH successfully to my
auth and file servers.

Cheers,
Steve


------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T752f10d492990bed-Me4dcc93599f000ff2aac1318
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2023-01-03 19:07 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-12-09  0:06 [9fans] Re: Fun with sshsession Steven Stallion
2022-12-19 22:27 ` Brian L. Stuart
2023-01-03 19:07   ` Steven Stallion
  -- strict thread matches above, loose matches on Subject: below --
2022-12-07 17:36 Steven Stallion
2022-12-07 18:39 ` michaelian ennis
2022-12-07 18:41   ` Steven Stallion

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).