[9front] local auth without cpu service

[9front] local auth without cpu service

[alex]

Hello, 

I would like to use factotum on my notebook, without running a cpu service on it (since it is the only 9front device in my network at the moment).

At the moment I don't understand all the dependencies, but when I understand the fqa correctly, I think it is something like this:

- edit /lib/ndb/local, so the local system will be used as auth (setting "auth" and "authdom" matching to "sys", "ipnet" and "dom")
- setting nvram in plan9.ini (in the fqa it states: "nvram=#S/YOURDRIVE/nvram", so I've added "nvram=#S/sdE1/nvram", but I'm not sure whether it should read "nvram=local!/dev/sdE1/nvram", since "ls #S" is showing glenda's home dir and nobootprompt in plan9.ini has the value "local!/dev/sdE1/fscache")
- running auth/wrkey (for making use of the nvram?)
- adding user to the auth server ("auth/keyfs" and "auth/changeuser glenda")
- set up secstored ("mkdir /adm/secstore" and "chmod 770 /adm/secstore")
- start secstored at boot time ("echo auth/secstored > /cfg/$sysname/termrc")
- adding glenda to secstore (auth/secstore glenda")
- using secstore with ipso

I can't use ipso ("secstore read failed - bad password?"), but I think, I know why that is.. I've set no secstore password in auth/wrkey, but I've added glenda to secstore setting a password). Are these steps correct in principle? Can I redo my first auth/wrkey prompts?

Thank you very much in advance!

Best regards, 
Alex

Re: [9front] local auth without cpu service

[sirjofri]

Hi,

I guess there's some big misunderstanding. Factotum doesn't need secstore, not does it need any working network configuration. You can just start factotum and use it.

However, factotum needs the keys. The canonical way to feed it with keys is by using secstore, but that's not a hard dependency. Also, in the future there will be some "replacement" for secstore, for security reasons.

To keep things short, to feed factotum with keys:

auth/factotum -n # run factorum without asking secstore
echo $mykey > /mnt/factotum/ctl # key syntax the same as with secstore

Use it!

There's one thing to note: factorum expects keys one write at a time. That means you can't just cat your secrets from a file that easily, but you can drop a "read -m" between it:

cat mysecrets | read -m > /mnt/factotum/ctl

(I think it was read with -m).

Your mysecrets file should be encrypted in a way, or otherwise secured.

sirjofri


27.06.2024 09:18:33 alex <alex9-ml@proton.me>:
> Hello,
>
> I would like to use factotum on my notebook, without running a cpu service on it (since it is the only 9front device in my network at the moment).
>
> At the moment I don't understand all the dependencies, but when I understand the fqa correctly, I think it is something like this:
>
> - edit /lib/ndb/local, so the local system will be used as auth (setting "auth" and "authdom" matching to "sys", "ipnet" and "dom")
> - setting nvram in plan9.ini (in the fqa it states: "nvram=#S/YOURDRIVE/nvram", so I've added "nvram=#S/sdE1/nvram", but I'm not sure whether it should read "nvram=local!/dev/sdE1/nvram", since "ls #S" is showing glenda's home dir and nobootprompt in plan9.ini has the value "local!/dev/sdE1/fscache")
> - running auth/wrkey (for making use of the nvram?)
> - adding user to the auth server ("auth/keyfs" and "auth/changeuser glenda")
> - set up secstored ("mkdir /adm/secstore" and "chmod 770 /adm/secstore")
> - start secstored at boot time ("echo auth/secstored > /cfg/$sysname/termrc")
> - adding glenda to secstore (auth/secstore glenda")
> - using secstore with ipso
>
> I can't use ipso ("secstore read failed - bad password?"), but I think, I know why that is.. I've set no secstore password in auth/wrkey, but I've added glenda to secstore setting a password). Are these steps correct in principle? Can I redo my first auth/wrkey prompts?
>
> Thank you very much in advance!
>
> Best regards,
> Alex