4

I am attempting to setup a centralized home-directory server through sshfs and pam-mount.

Currently I am stuck at this point:

When attempting to mount the remote home directory sshfs just gets stuck:

d_inevitable@laptop:~$ sshfs -o nonempty,debug server: .
FUSE library version: 2.9.0
nullpath_ok: 0
nopath: 0
utime_omit_ok: 0

It freezes at this point.

This seems to be because the home directory includes ~/.ssh. So when I try sshfs -o nonempty server:.ssh .ssh the same thing happens.

I suppose fuse somehow initializes the mount, but then ssh needs something from it's config directory so it tries to read from it. Fuse will just block that read resulting in a deadlock.

What kind of stuff does sshfs need from ~/.ssh?

I have tried to remove all read/write permissions from ~/.ssh and then mounting on some other directory. That worked fine. The debug output only complained about writing to .ssh/known_hosts.

5
  • Using sshfs sounds like a bad idea offhand. Why aren't you using NFS??
    – Chris S
    May 9, 2013 at 18:03
  • @chriss for security reasons. It would be very difficult to satisfy the same requirements with NFS. May 9, 2013 at 18:23
  • @chriss actually the main reason is this: serverfault.com/questions/200759/… May 9, 2013 at 22:05
  • Oh, that's a strange limitation, I guess I'm used to -nix systems that make sense.
    – Chris S
    May 10, 2013 at 1:50
  • @chriss I suppose I could convert ecryptfs to a truecrypt volume and then krb5p NFS should work, but that would be a very long and bumpy road (resize partitions, transfer data, key management, etc). May 10, 2013 at 6:34

1 Answer 1

4

You are right, fuse initiates the mount first, then initiates the ssh process. This causes a problem for you, since by default ssh reads ~/.ssh/ssh_config, ~/.ssh/known_hosts


, ~/.ssh/id_* files from user home. This behavior can be changed:

  1. ~/.ssh/ssh_config is the default per-user configuration file. An alternative per-user configuration file can be specified using -F option, or use -F /dev/null to specify no per-user configuration file.
  2. ~/.ssh/known_hosts is used to store and check host keys. You can use -o UserKnownHostsFile=/dev/null, and either manually add the host key to /etc/ssh/ssh_known_hosts or use -o StrictHostKeyChecking=no.
  3. ~/.ssh/id_* files are identity files by default used for client authentication. If you want to authenticate using an identity file, you need to keep it outside the home directory and use -o IdentitiesOnly=yes -o IdentityFile=<path to private key>. Or else you can authenticate interactively if you use -o IdentitiesOnly=yes -o IdentityFile=/dev/null -o PubkeyAuthentication=no.

For example to mount home using sshfs, authenticating using password, without host key checking, run

sshfs user@server: ~/ -o nonempty -F /dev/null -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o IdentitiesOnly=yes -o IdentityFile=/dev/null -o PubkeyAuthentication=no
1
  • Per the OP, the user wants to combine this with pam_mount. This can be done by following your instructions, and adding the above to /etc/security/pam_mount.conf.xml like so: ` <fusemount>mount.fuse %(VOLUME) %(MNTPT) -F /dev/null -o UserKnownHostsFile=/dev/null -o IdentitiesOnly=yes -o IdentityFile=/dev/null -o %(OPTIONS)</fusemount> <volume fstype="fuse" path="sshfs#%(USER)@localhost:/home/%(USER)" mountpoint="~" ssh="1" options="reconnect,idmap=user,password_stdin,nonempty" /> `
    – Luciano
    Oct 6, 2019 at 15:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .