[9front] dp9ik plugins for pam and bsd auth.

[9front] dp9ik plugins for pam and bsd auth.

[Jacob Moody]

Hello all,

I sent some mail previously regarding some work on a standalone tlsclient ripped out of drawterm.
The repo[0] now contains a pam module and bsd auth executable for use in making UNIX system
authentication defer to a 9front authentication server. The ssl library has been changed
to use openssl rather then gnutls as well. I personally have been using the pam module for a
couple months now and haven't had much issue with it. I figure this might be interesting
to those running a hybrid network.

Thanks,
moody

[0] http://shithub.us/moody/tlsclient/HEAD/info.html

Re: [9front] dp9ik plugins for pam and bsd auth.

[ori]

Quoth Jacob Moody <moody@mail.posixcafe.org>:
> Hello all,
> 
> I sent some mail previously regarding some work on a standalone tlsclient ripped out of drawterm.
> The repo[0] now contains a pam module and bsd auth executable for use in making UNIX system
> authentication defer to a 9front authentication server. The ssl library has been changed
> to use openssl rather then gnutls as well. I personally have been using the pam module for a
> couple months now and haven't had much issue with it. I figure this might be interesting
> to those running a hybrid network.
> 
> Thanks,
> moody
> 
> [0] http://shithub.us/moody/tlsclient/HEAD/info.html
> 

Thanks, this actually looks like something I should try out.

...So, who's going to do the factotum based chrome password
manager extension?

Re: [9front] dp9ik plugins for pam and bsd auth.

[hiro]

i don't really trust web browsers to hold a temporary and esp. not a
long-term key for any secure session...

you'd need quic/https support inside factotum and the browser needs to
proxy through that...

it's hopeless. but that was the joke i guess ;)

On 9/8/21, ori@eigenstate.org <ori@eigenstate.org> wrote:
> Quoth Jacob Moody <moody@mail.posixcafe.org>:
>> Hello all,
>>
>> I sent some mail previously regarding some work on a standalone tlsclient
>> ripped out of drawterm.
>> The repo[0] now contains a pam module and bsd auth executable for use in
>> making UNIX system
>> authentication defer to a 9front authentication server. The ssl library
>> has been changed
>> to use openssl rather then gnutls as well. I personally have been using
>> the pam module for a
>> couple months now and haven't had much issue with it. I figure this might
>> be interesting
>> to those running a hybrid network.
>>
>> Thanks,
>> moody
>>
>> [0] http://shithub.us/moody/tlsclient/HEAD/info.html
>>
>
> Thanks, this actually looks like something I should try out.
>
> ...So, who's going to do the factotum based chrome password
> manager extension?
>
>

Re: [9front] dp9ik plugins for pam and bsd auth.

[unobe]

Quoth ori@eigenstate.org:
> Quoth Jacob Moody <moody@mail.posixcafe.org>:
> > Hello all,
> > 
> > I sent some mail previously regarding some work on a standalone tlsclient ripped out of drawterm.
> > The repo[0] now contains a pam module and bsd auth executable for use in making UNIX system
> > authentication defer to a 9front authentication server. The ssl library has been changed
> > to use openssl rather then gnutls as well. I personally have been using the pam module for a
> > couple months now and haven't had much issue with it. I figure this might be interesting
> > to those running a hybrid network.
> > 
> > Thanks,
> > moody
> > 
> > [0] http://shithub.us/moody/tlsclient/HEAD/info.html
> > 

This is great! Thanks moody.
 
> Thanks, this actually looks like something I should try out.
> 
> ...So, who's going to do the factotum based chrome password
> manager extension?

An extension would be nice.  I began working on a factotum extension
but decided to just write a JS snippet that communicates via a
websocket to a Perl process that was a pass-through to (p9p's)
factotum.  IIRC, 'twas non-trivial to write an extension, so I took
the path of least resistance.  The JS snippet was rudimentary--I had
stored it as a bookmark so I could "fill in" whichever site I was
using.  I haven't used it for more than a year (tempus volat), but I
can post it somewhere if anyone is interested in looking at the JS and
Perl.  I never did get the 'confirm' functionality implemented within
the browser, but maybe that was a benefit since the browser didn't
have full control of the secstore and the confirmation had to occur
outside the browser.