4 ms·
The architecture does indeed come from the late 80s/early 90s, but I think it's more relevant today than ever. Separation of services is, in my opinion, essenti
by floren 9y ago
The architecture does indeed come from the late 80s/early 90s, but I think it's more relevant today than ever. Separation of services is, in my opinion, essential to security. By putting the authentication service off in its own machine, you restrict the attacks that can be made on it; the auth server only talks over a highly restricted protocol. On a standalone Unix system, users log in to the same machine that stores the passwords. They're only a privilege escalation exploit away from getting the hashes of everyone's password, and these days privilege escalations are a dime a dozen.
When this scheme was designed, it was frankly a little bit nutty. The CPU, auth, and file servers would be VAX or Sun systems, costing tens of thousands of dollars, and the terminals would be either slightly cheaper Suns or IBM PC-compatibles costing thousands of dollars themselves. Today, you could probably cobble together a passable network for a few hundred dollars, assuming you use cheap Atom boards for everything except the CPU server (which is meant to be a beefy compute box, but let's be honest nothing in Plan 9 uses a lot of cycles). This makes the architecture more sensible than ever.
- ww520 9y agoNumerous centralized authentication services are available for Linux and Windows and others for a long time.
- floren 9y agoYou're absolutely correct, and like I said a lot of people run their Plan 9 systems with all the services on one box, which kills a lot of the security advantages. However, if you compare setting up a Plan 9 auth server to setting up a Kerberos server... well, basically anything to do with Kerberos makes me long for death. The Plan 9 auth system is one of the best things they made and I highly recommend checking out the paper: https://css.csail.mit.edu/6.858/2013/readings/plan9auth.pdf https://css.csail.mit.edu/6.858/2013/readings/plan9auth.pdf
- nine_k 9y agoCan the component machines be run as VMs on fewer / one physical machine? It would make for a better QubesOS then.
- floren 9y agoYes, I've used minimega to run a bunch of Harvey VMs for experimental use. https://github.com/Harvey-OS/harvey/wiki/Using-minimega-to-run-dozens-of-Harvey-VMs https://github.com/Harvey-OS/harvey/wiki/Using-minimega-to-r...
- nuntius 9y agoIf you emulate a dozen machines on one physical machine, then a single exploit can traverse them all. If you pack a dozen "single board computers" in a case and give each a single function, then entire classes of attack are ruled out.
- cjhanks 9y agoIt seems a bit older than that. Much of the design goals for Harvey were in the early MULTICS systems of the 70's. In some ways I view Plan9 as Bell Labs attempt to bridge the great components of MULTICS and UNIX together.
- thisrod 9y agoThe way I see that history, Multics was the second system that never shipped, and Plan 9 was the fourth system that belatedly did ship Multics.
- cjhanks 9y agoI don't mean to be argumentative. MULTICS was in use by Honeywell Aerospace into the early 90's simulating physics models. There was a centralized computer which was programmed via punch cards which you could dial into to submit your specific simulation and later return to for results.
- thisrod 9y agoGood point. Multics was used just as much, or little, as Plan 9 was. We might wish our predecessors had made the jump to distributed, securable operating systems, but there was never a time at which it made sense to do so.
- euyyn 9y ago> On a standalone Unix system, users log in to the same machine that stores the passwords. They're only a privilege escalation exploit away from getting the hashes of everyone's password But what machines are, in practice, multiuser today in that way? My work computer has only my account, and sometimes a temporary one if a technician needs to log in to troubleshoot something. For home use I don't think it makes sense. And for a prod network, again users aren't logging into the machines directly.