Re: [9fans]

[andrey mirtchovski <mirtchov@cpsc.ucalgary.ca>]

> andrey mirtchovski wrote:
>
>  > you won't need a secstore for your installation to work.
>
> OK, I guess I don't need it for connecting with drawterm,
> either. But apparently I need it for SSH and pulling
> updates. I may also need it for other stuff. I'm running
> an app that makes a call to auth_getuserpasswd() and it
> fails now that I've tried to setup securestore; it used to
> get past that point before.

you don't need secstore for pulling from sources.  you don't need it
to ssh out from Plan 9, you don't even (necessarily) need it to ssh to
the Plan 9 machine (though you'll get a warning for the changed key
every time you reinitialize with auth/rsagen, i.e.  after a reboot).

in fact, secstore can be left as the last thing you setup, after
having made sure everything else works -- it's just a (very useful!)
convenience.

> The mkdirs were done before.  One small issue, factotum
> wanted /adm/secstore/store/bootes/factotum/ (I think it
> was).
>
>  > on auth server:
>  >
>  >     auth/secstored
>  >     mkdir /adm/secstore
>  >     mkdir /adm/secstore/store
>  >     mkdir /adm/secstore/who
>  >     auth/secuser dpx
>  >

did this succeed?

you've read the secstore(1) man page, i presume?  it basically
explains why the above steps should be taken (and why there should be
a chmod 770 somewhere in there too):

          Secuser is an administrative command that runs on the sec-
          store machine, normally the authserver, to create new
          accounts and to change status on existing accounts.  It
          prompts for account information such as password and expira-
          tion date, writing to /adm/secstore/who/$uid.  The
          /adm/secstore directory should be created mode 770 for the
          userid or groupid of the secstored process.

	[...]

          /adm/secstore/who/$uid secstore account name, expiration
          date, verifier
          /adm/secstore/store/$uid/ users' files

>  > on terminal:
>  >
>  >     touch /tmp/factotum
>  >     auth/secstore -p /tmp/factotum
>  >       ramfs -p; cd /tmp
>  >     auth/secstore -g factotum
>  >     secstore password:
>  >     echo 'key proto=apop dom=x.com user=dpx \
>  >             !password=y~1' >> factotum
>  >     auth/secstore -p factotum
>  >     secstore password:
>  >     cat factotum > /mnt/factotum/ctl
>
> This is where I'm still stuck.

so, what do you see (as the user who started secstored) in
/adm/secstore?  here's a sample from our machines:

	plan9# ls -l /adm/secstore/store/andrey
	--rw-rw---- M 4951 bootes bootes 696 Sep 15  2003 /adm/secstore/store/andrey/factotum
	plan9#

you should see a single file (factotum) if you've put it properly.
from what you gave above it looks like you're looking for a file named
'factotum' already existing in secstore, however when you initialize a
user's secstore there's absolutely nothing in it -- you need to put
the files there first.

>
> Now I get to the ramfs stage! However, secstore -g complains
> about /tmp/factotum not existing. If I skip the
> ramfs step, I see this:
>
>     cpu% auth/secstore -g factotum
>     secstore password:
>     secstore
>     implausible filesize for factotum
>     secstore cmd failed
>
> On the console of the PC, I see "implausible filesize -1
> for factotum," but no information about which file is too
> small.
>

secstore doesn't have any files in it by default, it just encrypts
whatever you decide to store in it.  usually that is a file suitable
for initializing your factotum.

it looks like you have a bad file in it, so all you need to do is
remove it and store it anew.  here's how to do it:

	% auth/factotum # hit enter on the 'secstore password' prompt
	% ramfs -p
	# you may wish to log in to a few places before the next step,
	# just to make sure you have as many passwords as you can
	# from the beginning. ssh to one or two machines, just for fun
	% cat /mnt/factotum/ctl > /tmp/factotum
	% cd /tmp
	# edit /tmp/factotum and change all question marks to the actual
	# passwords you use, for example if /mnt/factotum/ctl has:
	#	key proto=p9sk1 dom=plan9.ca user=somebody !password?
	# in /tmp/factotum it should appear as:
	#	key proto=p9sk1 dom=plan9.ca user=somebody !password=mypassword
	%
	# now simply add this file to the secstore:
	% auth/secstore -p factotum
	# and kill the ramfs session (^D)

and verify that the new password works by starting a new factotum and
attempting to login to one of the machines whose passwords you've
added to the factotum file in secstore.  if doing it for bootes you
may want to add the ssh server key there too (follow the ssh(1)
instructions)

andrey