Re: [9fans] Maintenance of an auth server files vs a dns+dhcp+tftp server

[Stanley Lieber <sl@9front.org>]

Ole-Hjalmar Kristensen <ole.hjalmar.kristensen@gmail.com> wrote:

>On Tue, Nov 15, 2016 at 8:05 PM, Stanley Lieber <sl@9front.org> wrote:
>
>> "James A. Robinson" <jim.robinson@gmail.com> wrote:
>>
>> >So in a canonical installation the auth server mounts its root from
>the
>> >file server?
>> >
>> >On Tue, Nov 15, 2016 at 10:47 AM Stanley Lieber <sl@9front.org>
>wrote:
>> >
>> >> The idea is that there is one file system shared by all the
>> >neighboring
>> >> systems. The canonical Plan 9 installation comprises one disk file
>> >server
>> >> and many diskless computing machines (auth servers, cpu servers,
>> >terminals).
>> >>
>>
>> Yes. You can arrange for hands-free booting by storing  the same
>> authid/authdom/password in the nvram of both the file server and the
>auth
>> server. I usually boot the auth server from a 9fat partition or a USB
>key,
>> then tcp (actually, tls) mount the root file system from the file
>server.
>>
>> sl
>>
>>
>Is this the reason that it is actually possible to boot a combined
>auth/cpu/file server at all? I mean, the auth server stores /adm/keys
>on
>the file server, right? And normally you would need to authenticate
>yourself to attach to the file server, which would be kind of
>difficult,
>since it is the auth server that is trying to access the key file...
>
>Ole-Hj.

Yes. File server boots and loads it's key from nvram into factotum. Auth server does the same. If both credentials match, the two machines will agree to talk to each other. The ticket is "forged" and factotum realizes it has enough information to perform the authentication without needing to consult the actual auth server.

sl