From mboxrd@z Thu Jan  1 00:00:00 1970
Message-ID: <ee9e417a05091522414815d0e8@mail.gmail.com>
Date: Fri, 16 Sep 2005 01:41:46 -0400
From: Russ Cox <rsc@swtch.com>
To: Fans of the OS Plan 9 from Bell Labs <9fans@cse.psu.edu>
Subject: Re: [9fans] killing processes
In-Reply-To: <16867.1126848615@piper.nectar.cs.cmu.edu>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
References: <5b58ed3b26b68a9a9751f6b79d306c10@orthanc.cc.titech.ac.jp>
	<16867.1126848615@piper.nectar.cs.cmu.edu>
Topicbox-Message-UUID: 8b06306a-ead0-11e9-9d60-3106f5b1d025

You don't need to run a second authentication server,
just a second authentication domain.  The way to do this
is to start the fossil as normal but then replace the usual
aux/listen command with

@{
    rfork n
    auth/factotum
    read -m new.factotum >/mnt/factotum/ctl
    aux/listen tcp
}

and then the listeners will be using the new factotum.
If you put in new.factotum (which should be handled
some other way but so be it) a key like

key proto=3Dp9sk1 user=3Ddavide dom=3Dother.cs.cmu.edu !password=3Dasdf

then you will find that cpu'ing into that machine will prompt
for a key from other.cs.cmu.edu, and your account will
be the only one that works (any others would require=20
an authentication server).

Russ