[9fans] examples for setting up secstore for a laptop (i.e. terminal)

[9fans] examples for setting up secstore for a laptop (i.e. terminal)

[rminnich]

[-- Attachment #1: Type: text/plain, Size: 761 bytes --]

It's been a few years since I did this ...

 I'm trying to remember how to set up secstore as I'd like to save, e.g., WPA2 passwords, iCloud application specific password, all that good stuff. I don't actually know where to look for useful docs. 

I see the nice ipso tool from 9front, and have memories of using factotum for this,  I'm more trying to recall simple mechanical bits, e.g., where do people commonly put their secstore, where in termrc do you have the bits to read it, etc.

Any info much appreciated. Thanks.

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T4238421df7f31f11-Md3cb9bfcfc9a1403fdf8a523
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

[-- Attachment #2: Type: text/html, Size: 1388 bytes --]

Re: [9fans] examples for setting up secstore for a laptop (i.e. terminal)

[ori]

Quoth rminnich@p9f.org:
> It's been a few years since I did this ...
> 
>  I'm trying to remember how to set up secstore as I'd like to save, e.g., WPA2 passwords, iCloud application specific password, all that good stuff. I don't actually know where to look for useful docs. 
> 
> I see the nice ipso tool from 9front, and have memories of using factotum for this,  I'm more trying to recall simple mechanical bits, e.g., where do people commonly put their secstore, where in termrc do you have the bits to read it, etc.
> 
> Any info much appreciated. Thanks.


https://fqa.9front.org/fqa7.html#7.4.3

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T4238421df7f31f11-Mc0a64414f251eeb442c3195a
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

Re: [9fans] examples for setting up secstore for a laptop

[Richard Miller]

> I don't actually know where to look for useful docs. 

cpu% lookman secstore
man 1 secstore # secstore(1)
man 1 ssh2 # ssh2(1)
man 2 aes # aes(2)
man 2 authsrv # authsrv(2)
man 4 cwfs # cwfs(4)
man 4 factotum # factotum(4)
man 4 ssh # ssh(4)
man 8 drawterm # drawterm(8)
man 8 plan9.ini # plan9.ini(8)
man 8 secstore # secstore(8)

> ... where do people commonly put their secstore

secstore(8) says:
         Secuser is an administrative command that runs on the sec-
         store machine, normally the authserver,
    ...
    FILES
          /adm/secstore/who/user     secstore account name, expiration
                                     date, verifier
          /adm/secstore/store/user/  user 's file storage


> ... where in termrc do you have the bits to read it, etc.

factotum(4) says:
          By default when factotum starts it looks for a secstore(1)
          account on $auth for the user and, if one exists, prompts
          for a secstore password in order to fetch the file factotum,
          which should contain control file commands.  An example
          would be
            key dom=x.com proto=p9sk1 user=boyd !hex=26E522ADE2BBB2A229
            key proto=rsa service=ssh size=1024 ek=3B !dk=...
          ...

So you don't need anything in termrc. Once you've given yourself a
secstore account and stored a factotum file there with 'auth/secstore -p',
the terminal boot process will prompt you for a secstore password instead
of your terminal password, before termrc is run.

You do need to start secstored in cpurc or in /cfg/$authserver/cpurc


------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T2e892f330bc0513b-Mbf7af6d200a95a2963a3df85
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

Re: [9fans] examples for setting up secstore for a laptop

[sirjofri]

Hi,

In the original thread message, rminnich is asking for wpa2 passwords, so I assume you need ot for connecting your laptop to a network - which is an important point in this thread, if you need the wpa2 keys to be able to network in the first place.

Running auth/factotum is generally the official way to query secstore for secrets, but secstore is a server, for which you need an existing network connection.

It is however possible to run factotum without connecting to the secstore server, and fill it with your own secrets:

auth/factotum -n
cat mysecrets | read -m > /mnt/factotum/ctl

The read -m is needed so each secret gets its own write. Instead of catting the file directly it is possible to encrypt it. The encrypted file needs to be stored somewhere in physical reach (not via network), for example a thumb drive or a local disk file.

After running that and establishing your wifi connection, you can just fill the existing factotum with your secstore secrets, or just run a new auth/factotum (without -n) before starting rio, or whatever you like.

Note that (at least on 9front systems) it is possible to specify a single wpa2 key in the plan9.ini file, and it would be possible to put your wpa2 keys in the boot paq file.

sirjofri

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T2e892f330bc0513b-M54fe8f2131969a862ac9f091
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

Re: [9fans] examples for setting up secstore for a laptop

[Ron Minnich]

Thanks, I had decided to go the lazy route as you mentioned and fill
factotum directly.


On Tue, Dec 17, 2024 at 2:43 PM sirjofri <sirjofri+ml-9fans@sirjofri.de> wrote:
> 
> Hi,
> 
> In the original thread message, rminnich is asking for wpa2 passwords, so I assume you need ot for connecting your laptop to a network - which is an important point in this thread, if you need the wpa2 keys to be able to network in the first place.
> 
> Running auth/factotum is generally the official way to query secstore for secrets, but secstore is a server, for which you need an existing network connection.
> 
> It is however possible to run factotum without connecting to the secstore server, and fill it with your own secrets:
> 
> auth/factotum -n
> cat mysecrets | read -m > /mnt/factotum/ctl
> 
> The read -m is needed so each secret gets its own write. Instead of catting the file directly it is possible to encrypt it. The encrypted file needs to be stored somewhere in physical reach (not via network), for example a thumb drive or a local disk file.
> 
> After running that and establishing your wifi connection, you can just fill the existing factotum with your secstore secrets, or just run a new auth/factotum (without -n) before starting rio, or whatever you like.
> 
> Note that (at least on 9front systems) it is possible to specify a single wpa2 key in the plan9.ini file, and it would be possible to put your wpa2 keys in the boot paq file.
> 
> sirjofri

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T2e892f330bc0513b-Mc57da6b11f438a528f21b713
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

Re: [9fans] examples for setting up secstore for a laptop

[Ron Minnich]

for some reason, they wrkey/keyfs/secstored/secstore/factotum dance
was something I always struggled with. Some things never change ;-)

I also just realized: it seems there is no route to 127.0.0.1 -- is
this intentional?


On Tue, Dec 17, 2024 at 4:01 PM Ron Minnich <rminnich@p9f.org> wrote:
>
> Thanks, I had decided to go the lazy route as you mentioned and fill
> factotum directly.
>
>
> On Tue, Dec 17, 2024 at 2:43 PM sirjofri <sirjofri+ml-9fans@sirjofri.de> wrote:
> > 
> > Hi,
> > 
> > In the original thread message, rminnich is asking for wpa2 passwords, so I assume you need ot for connecting your laptop to a network - which is an important point in this thread, if you need the wpa2 keys to be able to network in the first place.
> > 
> > Running auth/factotum is generally the official way to query secstore for secrets, but secstore is a server, for which you need an existing network connection.
> > 
> > It is however possible to run factotum without connecting to the secstore server, and fill it with your own secrets:
> > 
> > auth/factotum -n
> > cat mysecrets | read -m > /mnt/factotum/ctl
> > 
> > The read -m is needed so each secret gets its own write. Instead of catting the file directly it is possible to encrypt it. The encrypted file needs to be stored somewhere in physical reach (not via network), for example a thumb drive or a local disk file.
> > 
> > After running that and establishing your wifi connection, you can just fill the existing factotum with your secstore secrets, or just run a new auth/factotum (without -n) before starting rio, or whatever you like.
> > 
> > Note that (at least on 9front systems) it is possible to specify a single wpa2 key in the plan9.ini file, and it would be possible to put your wpa2 keys in the boot paq file.
> > 
> > sirjofri

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T2e892f330bc0513b-M940ef9cf8ae272b9b3631a21
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

Re: [9fans] examples for setting up secstore for a laptop

[hiro]

> for some reason, they wrkey/keyfs/secstored/secstore/factotum dance
> was something I always struggled with. Some things never change ;-)

maybe we should get rid of secstore then? or how could it be made useful?

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T2e892f330bc0513b-M8ec60b17b67b6b91999c11b2
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

Re: [9fans] examples for setting up secstore for a laptop

[sirjofri]

18.12.2024 04:05:52 hiro <23hiro@gmail.com>:
>> for some reason, they wrkey/keyfs/secstored/secstore/factotum dance
>> was something I always struggled with. Some things never change ;-)
>
> maybe we should get rid of secstore then? or how could it be made useful?

Iirc it's quite insecure also. At least, cinap mentioned something like that some time ago (check the 9front ml archive, a few months ago, if you want). He also said that he basically has another solution that just needs some combination with other tools/services. The solution would be based around stashfs[1].

Personally, is welcome a more secure solution. I'm not a security guy myself, but if people warn me that I should not run secstore on a publicly reachable service... I mean, it's like putting your keys right in front of the door. Or inside a pot in front of the door since nobody knows about secstore, so it's at least somewhat hidden.

In general, the handling of secstore is "fine" in my opinion. It's a separate service with it's own user management and a separate installation routine for cpu servers. I think everything is pretty much understandable if you start dissecting "the whole" in your mind to understand the individual components. The individual commands make sense then (even though you always need to read the man pages[2] to manage it since you don't touch that part of the system very often).

sirjofri

[1] https://shithub.us/cinap_lenrek/stashfs/HEAD/info.html
[2] I find myself being lazy and reading the fqa instead. Sometimes the man pages list all the parts, but don't show how it's done. Like, there's no "Getting Started" or "Quick Start Guide", and plan 9's not ikea.

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T2e892f330bc0513b-M168e79b077a072dbe954da15
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

Re: [9fans] examples for setting up secstore for a laptop

[Frank D. Engel, Jr.]

I use it (in my 9front Pi cluster).  Works for me.

It could probably use some improvement in terms of tools for managing 
the stored keys, plus I never figured out how to avoid needing to enter 
my secstore password twice instead of just once every time I log in, but 
it's not exactly broken.


On 12/17/24 19:57, hiro wrote:
>> for some reason, they wrkey/keyfs/secstored/secstore/factotum dance
>> was something I always struggled with. Some things never change ;-)
> maybe we should get rid of secstore then? or how could it be made useful?

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T2e892f330bc0513b-Md30d0519315c094b09d2287f
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

Re: [9fans] examples for setting up secstore for a laptop

[Ron Minnich]

I spent years working with chromebooks and once I did a coordinate
transformation from that security model to what Plan 9 does, things
made a lot more sense :-)

That said, I think, if anyone has time, it's worth taking a look at
what chromebooks did for security. It might have some use in the
future for plan 9.

Thanks all, this discussion got some neurons back on line and things
are kind of working ...

On Wed, Dec 18, 2024 at 5:20 AM Frank D. Engel, Jr. <fde101@fjrhome.net> wrote:
>
> I use it (in my 9front Pi cluster).  Works for me.
>
> It could probably use some improvement in terms of tools for managing
> the stored keys, plus I never figured out how to avoid needing to enter
> my secstore password twice instead of just once every time I log in, but
> it's not exactly broken.
>
>
> On 12/17/24 19:57, hiro wrote:
> >> for some reason, they wrkey/keyfs/secstored/secstore/factotum dance
> >> was something I always struggled with. Some things never change ;-)
> > maybe we should get rid of secstore then? or how could it be made useful?

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T2e892f330bc0513b-M428cb6b9975fda0b2ac040d8
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

Re: [9fans] examples for setting up secstore for a laptop

[Lyndon Nerenberg (VE7TFX/VE6BBM)]

hiro writes:

> maybe we should get rid of secstore then? or how could it be made useful?

Not replace.  Sectore is useful for more than just factotum.

But the sectore interface is very clunky, and I think that's
what turns people away from it.  While I keep confidential
files other than factotum in secstore, I always hate having
to work with them, because the interface is so disruptive.

But I also never used the secstore often enough to get annoyed
enough to try to do something about it.

--lyndon

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T2e892f330bc0513b-Mfecce6742ad43e92bc532df8
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

Re: [9fans] examples for setting up secstore for a laptop

[Lyndon Nerenberg (VE7TFX/VE6BBM)]

Lyndon Nerenberg (VE7TFX/VE6BBM) writes:

> Not replace.

Sorry, I meant to say 'not remove'.

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T2e892f330bc0513b-Ma0552d37a1adaae36de251d7
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

Re: [9fans] examples for setting up secstore for a laptop

[a]

I like secstore, but the chicken-or-egg question is real. It's
from the world where you have a dedicated auth server, and that
doesn't always track with a laptop needing a key to get to the
network. I do store my wpa key outside secstore for this reason,
and then use it for everything else. Still, if you've got a
local filesystem, I think that's all you need to bootstrap.

When I have a system that needs a wpa key, I have this in
my /cfg/sysname/termrc:

        echo 'key proto=wpapsk essid=Ranch !password='^`{cat $home/lib/wpa/Ranch} > /mnt/factotum/ctl
        aux/wpa -p2s Ranch /net/ether1
        ip/ipconfig -g 10.1.20.1 ether /net/ether1 add 10.1.20.120 255.255.255.0

I also have a script, 'feedkeys', which is just this:

        #!/bin/rc
        store=your.secstore.here
        auth/secstore -s $store -G factotum > /mnt/factotum/ctl

I end up using that script at other times, too, like calls in
from other environments (eg ssh). Then in my $home/lib/profile,
the 'case terminal' clause includes:

        if (! test -e /mnt/factotum/ctl)
                auth/factotum -a your.secstore.here
        feedkeys

With this, networking comes up without my intervention, I get all
my keys in factotum, and I only have to type my secstore password
once (and no others).

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T2e892f330bc0513b-Mdbf9da4fe44462b0ee63272d
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

Re: [9fans] examples for setting up secstore for a laptop

[Charles Forsyth]

[-- Attachment #1: Type: text/plain, Size: 737 bytes --]

I did a go implementation of secstore, for reasons, based on the Inferno
one, and the protocol isn't ideal at several points
(which I'd have to look up again), for error handling as I recall. it uses
AES in a CBC mode, over an RC4 SSL
(just for the records, not for anything really SSL). The Go
secfiles command follows the Inferno secstore command
in mimicking ar rather than Plan 9's secstore command. I've found the
functionality if not the interface of secstore to be
useful in several projects.

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T2e892f330bc0513b-Mb397395ad7d8ac5e824c9834
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

[-- Attachment #2: Type: text/html, Size: 1317 bytes --]

Re: [9fans] examples for setting up secstore for a laptop

[Clay Ayers - thedaemon via 9fans]

[-- Attachment #1: Type: text/plain, Size: 607 bytes --]

I still haven't managed to understand how to get my keys into factotum without having to manually push them each time. I have a script that runs the echo 'key proto', etc to /mnt/factotum/ctl for all of my passwords, but it's in an unencrypted text file. The instructions don't make sense to me on how to get this to work. I added this reply here because I think it's relevant..?
------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T2e892f330bc0513b-M65b7a28a8d630fb4fa20368c
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

[-- Attachment #2: Type: text/html, Size: 1125 bytes --]

Re: [9fans] examples for setting up secstore for a laptop

[Charles Forsyth]

[-- Attachment #1: Type: text/plain, Size: 1879 bytes --]

well, that's where secstore comes in for some of us. one of my lib/profile
contains
this ancient section

    auth/factotum
    fn secstore{
        {auth/secstore -G factotum -s $1 | read -m >/mnt/factotum/ctl} &&
fn secstore {}
    }
    for(a in $SECSTORE1 $SECSTORE2){
        secstore $a
    }

where SECSTOREn hold the domain names of each secstore server I control,
with the secrets replicated. the effect is to work through each one until
one succeeds.
if I only had one, it would be just

  auth/secstore -G factotum -s THESERVERNAME | read -m >/mnt/factotum/ctl

it fetches the keys from a file "factotum" on a secstore server, securely
subject to cinap, and read -m puts
them one at a time into factotum. auth/secstore will prompt for the
secstore password.

On Fri, 20 Dec 2024 at 19:46, Clay Ayers - thedaemon via 9fans <
9fans@9fans.net> wrote:

> I still haven't managed to understand how to get my keys into factotum
> without having to manually push them each time. I have a script that runs
> the echo 'key proto', etc to /mnt/factotum/ctl for all of my passwords, but
> it's in an unencrypted text file. The instructions don't make sense to me
> on how to get this to work. I added this reply here because I think it's
> relevant..?
> *9fans <https://9fans.topicbox.com/latest>* / 9fans / see discussions
> <https://9fans.topicbox.com/groups/9fans> + participants
> <https://9fans.topicbox.com/groups/9fans/members> + delivery options
> <https://9fans.topicbox.com/groups/9fans/subscription> Permalink
> <https://9fans.topicbox.com/groups/9fans/T2e892f330bc0513b-M65b7a28a8d630fb4fa20368c>
>

------------------------------------------
9fans: 9fans
Permalink: https://9fans.topicbox.com/groups/9fans/T2e892f330bc0513b-M8bc73f2fe56b3b32b19f0a9c
Delivery options: https://9fans.topicbox.com/groups/9fans/subscription

[-- Attachment #2: Type: text/html, Size: 2573 bytes --]

Re: [9fans] examples for setting up secstore for a laptop

[Anthony Sorace]

[-- Attachment #1: Type: text/html, Size: 2418 bytes --]