[9fans] p9 file server (npfs) w/ authentication from heterogenous systems

[9fans] p9 file server (npfs) w/ authentication from heterogenous systems

[Jakob Praher]

Dear all,

I have read a post from Eric Van Hensbergen about paravirtualized
filesystems. This was of interest to me, and I tried to pull npfs from
subversion. As a client I am using the 9pfuse to mount the tree of the
npfs server. Is this a good match, or should I use something from the
npfs tree directly? Is npfs the best choice if I would like to export
ufs like filesystems?

After getting it basically up I am facing typically newbie issues, and
I would like to share my problems with you in hope to find some
further directions in order to do some further RTFM.

My biggest issue is that I can only do read operations on the client.
How can I set up something like a basic authenticated connection. Just
to get the uid over to the npfs in order to act as the right user on
the server? I read a bit about factotum, yet I am not sure given the
npfs that it supports it...

Thank you in advance.
Jakob

Re: [9fans] p9 file server (npfs) w/ authentication from heterogenous systems

[Eric Van Hensbergen]

On Sun, Jan 25, 2009 at 7:44 AM, Jakob Praher <jp@hapra.at> wrote:
>
> I have read a post from Eric Van Hensbergen about paravirtualized
> filesystems. This was of interest to me, and I tried to pull npfs from
> subversion. As a client I am using the 9pfuse to mount the tree of the
> npfs server. Is this a good match, or should I use something from the
> npfs tree directly? Is npfs the best choice if I would like to export
> ufs like filesystems?
>

If you are on Linux you can use v9fs directly.
For servers there are lots of choices, but spfs/npfs are the only ones
(I know of) which support the UNIX extensions (for things like UID
mapping, etc.)
There is a comprehensive list: http://9p.cat-v.org/implementations

>
> My biggest issue is that I can only do read operations on the client.
> How can I set up something like a basic authenticated connection. Just
> to get the uid over to the npfs in order to act as the right user on
> the server? I read a bit about factotum, yet I am not sure given the
> npfs that it supports it...
>

This all depends on what you are trying to do, are you going
Linux<->Linux, Linux<->Plan9, something else?  Authentication isn't
currently supported by any of the UNIX servers (to my knowledge).  It
is possible to setup an authenticated connection from UNIX to Plan 9
using p9p.

        -eric

Re: [9fans] p9 file server (npfs) w/ authentication from heterogenous systems

[Steve Simon]

> Authentication isn't
> currently supported by any of the UNIX servers (to my knowledge).

Maybe it doesn't count in your eyes, but I use u9fs to serve
unix filesystems to plan9 - it supports authenticiation.

-Steve

Re: [9fans] p9 file server (npfs) w/ authentication from heterogenous systems

[Eric Van Hensbergen]

It sounded more like he wanted a UNIX based auth server, perhaps I misread.

          -eric


On Sun, Jan 25, 2009 at 8:58 AM, Steve Simon <steve@quintile.net> wrote:
>> Authentication isn't
>> currently supported by any of the UNIX servers (to my knowledge).
>
> Maybe it doesn't count in your eyes, but I use u9fs to serve
> unix filesystems to plan9 - it supports authenticiation.
>
> -Steve
>
>

Re: [9fans] p9 file server (npfs) w/ authentication fromheterogenous systems

[Jakob Praher]

Hi,


Eric Van Hensbergen <ericvh@gmail.com> schrieb:

> On Sun, Jan 25, 2009 at 7:44 AM, Jakob Praher <jp@hapra.at> wrote:
>>>
> If you are on Linux you can use v9fs directly.
> For servers there are lots of choices, but spfs/npfs are the only ones
> (I know of) which support the UNIX extensions (for things like UID
> mapping, etc.)
> There is a comprehensive list: http://9p.cat-v.org/implementations
>
I am currently on MacOS X and Linux. I thought that npfs is a successor of
v9fs? I have now also installed u9fs which is part of the Plan 9 iso. This
seams to be a complete Unix file system exporting solution for accesing
remote file systems from Plan 9. My question is if I use the Plan9 in user
space port on the client side it would be theoretically possible to use
the u9fs from non native Plan9 machines too?. What are the main problems I
am running into if I do it this way?


>
> This all depends on what you are trying to do, are you going
> Linux<->Linux, Linux<->Plan9, something else?  Authentication isn't
> currently supported by any of the UNIX servers (to my knowledge).  It
> is possible to setup an authenticated connection from UNIX to Plan 9
> using p9p.

As I said above if I have a native Linux file server and a Linux/Unix
client that is able to make use of the plan9port distribution, does that
enable  authenticated connections for me?

thanks
Jakob

>
>         -eric
>
>
>

Re: [9fans] p9 file server (npfs) w/ authentication fromheterogenous systems

[Jakob Praher]

Hi eric,

see my other post. I think I am open to any kind of mapping that works for me.
I have no problem setting up a plan9 like authentication scenario, since I
have only a couple of users in my scenario. Some pointers are greatly
appreciated.

thanks
Jakob


Eric Van Hensbergen <ericvh@gmail.com> schrieb:

> It sounded more like he wanted a UNIX based auth server, perhaps I misread.
>
>           -eric
>
>
> On Sun, Jan 25, 2009 at 8:58 AM, Steve Simon <steve@quintile.net> wrote:
>>> Authentication isn't
>>> currently supported by any of the UNIX servers (to my knowledge).
>>
>> Maybe it doesn't count in your eyes, but I use u9fs to serve
>> unix filesystems to plan9 - it supports authenticiation.
>>
>> -Steve
>>
>>
>
>
>

Re: [9fans] p9 file server (npfs) w/ authentication fromheterogenous systems

[Eric Van Hensbergen]

On Jan 25, 2009, at 3:17 PM, Jakob Praher <jp@hapra.at> wrote:

> Hi,
>
>
> Eric Van Hensbergen <ericvh@gmail.com> schrieb:
>
>> On Sun, Jan 25, 2009 at 7:44 AM, Jakob Praher <jp@hapra.at> wrote:
>>>>
>> (I know of) which support the UNIX extensions (for things like UID
>> mapping, etc.)
>> There is a comprehensive list: http://9p.cat-v.org/implementations
>>
> I am currently on MacOS X and Linux. I thought that npfs is a
> successor of
> v9fs?

No, v9fs is the kernel 9p client.  Npfs contains user space clients
and servers.


> I have now also installed u9fs which is part of the Plan 9 iso. This
> seams to be a complete Unix file system exporting solution for
> accesing
> remote file systems from Plan 9.

It is functional, but single threaded and synchronous.

> My question is if I use the Plan9 in user
> space port on the client side it would be theoretically possible to
> use
> the u9fs from non native Plan9 machines too?. What are the main
> problems I
> am running into if I do it this way?
>

No problems per say, but as the auth server hasn't been ported to p9p
you'll have to run a native plan 9 auth server or 9vx.

     -eric
>>
>>
>>
>>
>>

Re: [9fans] p9 file server (npfs) w/ authentication from heterogenous systems

[Nathaniel W Filardo]

[-- Attachment #1: Type: text/plain, Size: 345 bytes --]

On Sun, Jan 25, 2009 at 08:49:57AM -0600, Eric Van Hensbergen wrote:
> For servers there are lots of choices, but spfs/npfs are the only ones
> (I know of) which support the UNIX extensions (for things like UID
> mapping, etc.)

A quick look at npfs and spfs suggests that neither support p9sk1 auth?  Am
I misreading?

Thanks.
--nwf;

[-- Attachment #2: Type: application/pgp-signature, Size: 204 bytes --]

Re: [9fans] p9 file server (npfs) w/ authentication from heterogenous systems

[andrey mirtchovski]

> A quick look at npfs and spfs suggests that neither support p9sk1 auth?  Am
> I misreading?

one user-level 9p server/client which supports p9sk1 is Tim's python 9P library.

Re: [9fans] p9 file server (npfs) w/ authentication

[lucio]

> This
> seams to be a complete Unix file system exporting solution for accesing
> remote file systems from Plan 9.

Does u9fs (which I have used extensively for many years :-|) actually
provide proper authentication?  I never tought of it and I will try
the following experiment once my morning coffee actually takes hold:

 *	connect to a U9FS server from a compute server
 *	cpu to the compute server as a different user
 *	find out what identity is seen on the Unix server when (if)
	accessing the file system.

++L

Re: [9fans] p9 file server (npfs) w/ authentication from heterogenous systems

[Uriel]

On Sun, Jan 25, 2009 at 3:49 PM, Eric Van Hensbergen
<ericvh@gmail.com> > Authentication isn't  currently supported by any
of the UNIX servers (to my knowledge).

At least Inferno and one python 9p implementation do auth on Unix servers.

uriel

Re: [9fans] p9 file server (npfs) w/ authentication

[sqweek]

On Mon, Jan 26, 2009 at 1:13 PM,  <lucio@proxima.alt.za> wrote:
>> This
>> seams to be a complete Unix file system exporting solution for accesing
>> remote file systems from Plan 9.
>
> Does u9fs (which I have used extensively for many years :-|) actually
> provide proper authentication?

 It does p9sk1, but it consults a plain text file rather than a
factotum for its key.
-sqweek

Re: [9fans] p9 file server (npfs) w/ authentication

[lucio]

>  It does p9sk1, but it consults a plain text file rather than a
> factotum for its key.

Now I'm really surprised.  I guess I never actually looked.

++L

Re: [9fans] p9 file server (npfs) w/ authentication from heterogenous systems

[Eric Van Hensbergen]

On Sun, Jan 25, 2009 at 11:39 PM, Uriel <lost.goblin@gmail.com> wrote:
> On Sun, Jan 25, 2009 at 3:49 PM, Eric Van Hensbergen
> <ericvh@gmail.com> > Authentication isn't  currently supported by any
> of the UNIX servers (to my knowledge).
>
> At least Inferno and one python 9p implementation do auth on Unix servers.
>

Again, Inferno can use a Plan 9 auth server, but it doesn't (to my
knowledge) provide a server which can provide the Plan 9 auth service.
 It does provide its own auth services, but I've never attempted to
use factotum to authenticate against Inferno auth, so I'm not sure how
useful that would be from p9p.

There was some work to provide Plan 9 Auth services under UNIX that I
tried to help with (http://portal.acm.org/citation.cfm?id=1400101),
but to my knowledge it remains incomplete.

              -eric

Re: [9fans] p9 file server (npfs) w/ authentication from heterogenous systems

[roger peppe]

it's a bit awkward doing inferno auth with factotum, as you
have to manually manipulate the keys generated by the login(6)
process. it'd be nice if there was some way for a factotum
protocol to generate a key that stayed in long term storage (i.e. in secstore)
but currently, i don't think there's a way to do it, other
than manually.

2009/1/26 Eric Van Hensbergen <ericvh@gmail.com>:
> On Sun, Jan 25, 2009 at 11:39 PM, Uriel <lost.goblin@gmail.com> wrote:
>> On Sun, Jan 25, 2009 at 3:49 PM, Eric Van Hensbergen
>> <ericvh@gmail.com> > Authentication isn't  currently supported by any
>> of the UNIX servers (to my knowledge).
>>
>> At least Inferno and one python 9p implementation do auth on Unix servers.
>>
>
> Again, Inferno can use a Plan 9 auth server, but it doesn't (to my
> knowledge) provide a server which can provide the Plan 9 auth service.
>  It does provide its own auth services, but I've never attempted to
> use factotum to authenticate against Inferno auth, so I'm not sure how
> useful that would be from p9p.
>
> There was some work to provide Plan 9 Auth services under UNIX that I
> tried to help with (http://portal.acm.org/citation.cfm?id=1400101),
> but to my knowledge it remains incomplete.
>
>              -eric
>
>

Re: [9fans] p9 file server (npfs) w/ authentication from

[erik quanstrom]

> it's a bit awkward doing inferno auth with factotum, as you
> have to manually manipulate the keys generated by the login(6)
> process. it'd be nice if there was some way for a factotum
> protocol to generate a key that stayed in long term storage (i.e. in secstore)
> but currently, i don't think there's a way to do it, other
> than manually.

even a manual process would be cleaner and
likely more secure than the current setup:

	; echo export>/mnt/factotum/ctl
	; secstore password: *****

editing one's secstore factotum file is something
that's easy to get wrong and easy to do insecurely.
e.g. giving the wrong arguments to ramfs.

- erik

Re: [9fans] p9 file server (npfs) w/ authentication from heterogenous systems

[Charles Forsyth]

>it's a bit awkward doing inferno auth with factotum, as you
>have to manually manipulate the keys generated by the login(6)
>process.

at the moment if you use Inferno's auth/ai2key once (for each authinfo-format file)
you can add the resulting keys in text form to your secstore for later use by factotum
(with the inferno auth additions).  alternatively, you can add them
each time via ctl.  there isn't any way at the moment to add them on demand
(eg, through feedkey or similar), unlike passwords.

the factotum implementations need further changes to handle public key systems better,
assuming there is more than one system in use.  (eg, the keys are independent
from the authentication scheme that uses them.)

Re: [9fans] p9 file server (npfs) w/ authentication from heterogenous systems

[Steve Simon]

> ... it'd be nice if there was some way for a factotum
> protocol to generate a key that stayed in long term storage (i.e. in secstore)
> but currently, i don't think there's a way to do it, other
> than manually.

I was needing this recently - I have to change my windows filserver password
every couple of months. It would be nice if I could automate this process
having a program generate me a random password, passit to the server, and register
it into secstore.

alternatively I suspose I should just try and convince the IT dep to stop my
password from expiring.

Even more off topic - why do people think regular password expiry improves
system security (as opposed to enforcing a password complexity constraint)?
I know we have many passwords of the form <dictionary word><integer> where the
integer increments every few months...

-Steve

Re: [9fans] p9 file server (npfs) w/ authentication from heterogenous systems

[Charles Forsyth]

>Even more off topic - why do people think regular password expiry improves
>system security (as opposed to enforcing a password complexity constraint)?

i think the UNIX security paper discussed that.
(F. Grampp and R. Morris, "UNIX Operating System Security", BSTJ, Vol. 62, No . 8,. 1984)

Re: [9fans] p9 file server (npfs) w/ authentication from

[erik quanstrom]

>>Even more off topic - why do people think regular password expiry improves
>>system security (as opposed to enforcing a password complexity constraint)?
>
> i think the UNIX security paper discussed that.
> (F. Grampp and R. Morris, "UNIX Operating System Security", BSTJ, Vol. 62, No . 8,. 1984)

still a ppv (springer) article.  so without the benefit of reading
it ....

maybe the choice is false.

if you use the same password for 12 months or 12
passwords for one month, then your 12-month password
needs to be 12 times harder to crack, assuming you're
defending against the same assumed attack rate.

okay, maybe you're using something with 160 random
bits.  no way to crack that (play along, please), but
the 160 bits might be leaked.  in that case you need to
be 12x more careful with a 1 month password than a 12
month password, assuming that one is equally likely to
leak one's password on any given day.

otoh, the chance of recovering encrypted backups is
inversely proportial to the number of passwords you've
used. :-)

- erik

Re: [9fans] p9 file server (npfs) w/ authentication from heterogenous systems

[Jeff Sickel]

On Jan 25, 2009, at 8:43 PM, andrey mirtchovski wrote:

>> A quick look at npfs and spfs suggests that neither support p9sk1
>> auth?  Am
>> I misreading?
>
> one user-level 9p server/client which supports p9sk1 is Tim's python
> 9P library.

Which should be a relatively easy way to add a 9pserve to hg.  ro
initially, but it should be possible to implement a write|push as well.