Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Our home directories are exported via kerberized nfs, so the user needs a valid kerberos ticket to be able to mount its home. This setup works fine with our existing clients & server.

Now we want to add some 11.10 client and thus set up ldap & kerberos together with pam_mount. The ldap authentication works and users can login via ssh, however their homes can not be mounted.

When pam_mount is configured to mount as root, gssd does not find a valid kerberos ticket and the mount fails.

Nov 22 17:34:26 zelda rpc.gssd[929]: handle_gssd_upcall: 'mech=krb5 uid=0 enctypes=18,17,16,23,3,1,2 '
Nov 22 17:34:26 zelda rpc.gssd[929]: handling krb5 upcall (/var/lib/nfs/rpc_pipefs/nfs/clnt2)
Nov 22 17:34:26 zelda rpc.gssd[929]: process_krb5_upcall: service is '<null>'
Nov 22 17:34:26 zelda rpc.gssd[929]: getting credentials for client with uid 0 for server purple.physcip.uni-stuttgart.de
Nov 22 17:34:26 zelda rpc.gssd[929]: CC file '/tmp/krb5cc_65678_Ku2226' being considered, with preferred realm 'PURPLE.PHYSCIP.UNI-STUTTGART.DE'
Nov 22 17:34:26 zelda rpc.gssd[929]: CC file '/tmp/krb5cc_65678_Ku2226' owned by 65678, not 0
Nov 22 17:34:26 zelda rpc.gssd[929]: WARNING: Failed to create krb5 context for user with uid 0 for server purple.physcip.uni-stuttgart.de
Nov 22 17:34:26 zelda rpc.gssd[929]: doing error downfall

When pam_mount is on the other hand configured with the noroot=1 option, then it cannot mount the volume at all.

Nov 22 17:33:58 zelda sshd[2226]: pam_krb5(sshd:auth): user phy65678 authenticated as [email protected]
Nov 22 17:33:58 zelda sshd[2226]: Accepted password for phy65678 from 129.69.74.20 port 51875 ssh2
Nov 22 17:33:58 zelda sshd[2226]: pam_unix(sshd:session): session opened for user phy65678 by (uid=0)
Nov 22 17:33:58 zelda sshd[2226]: pam_mount(mount.c:69): Messages from underlying mount program:
Nov 22 17:33:58 zelda sshd[2226]: pam_mount(mount.c:73): mount: only root can do that
Nov 22 17:33:58 zelda sshd[2226]: pam_mount(pam_mount.c:521): mount of /Volumes/home/phy65678 failed

So how can we allow users of a specific group to perform nfs mounts? If this does not work, can we make pam_mount use root but pass the correct uid?

share|improve this question
    
This same problem applies to mounting CIFS shares with -osec=krb5 –  AdmiralNemo Mar 8 '12 at 2:42
    
Indeed, this problem has not been solved, yet. Shall I create another question with the same title and content or what do you mean by "repost"? –  janm Mar 8 '12 at 10:11
    
I thought with kerberized nfs, you mount as root (with the system keytab), but file access is done with each user's ticket. –  Jayen Mar 20 '12 at 3:52
    
removed query comment- will monitor –  Ringtail Mar 25 '12 at 18:31
    
Are you mounting /home /home/user or /home/user/mountpoint? The first one I think needs to be done prior to login. The second I have tried to do with sshfs, but it kept failing on GDM and lightdm login and I don't think it was sshfs's fault. The third should work, you just need to add the user to a group that is allowed to do nfs mounts. Please let me know though if you get the 2nd one to work. I'd be interested. –  d_inevitable Apr 4 '12 at 13:16

1 Answer 1

See this thread:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=190267

If there is no "user" option in fstab, only root can mount volumes. There is some comment in mount.c on making the mount command executable by any user, but that was rejected by the maintainer (the comment says something about security implications, but is not more specific).

In contrast to the original upstream, the Debian version of libpam-mount executes mount commands with the user uid, not as root. Doing user-specified mounts as root is a security hole. Any user then could mount a volume to /usr or /tmp on login, or umount any other volume on logout.

Or in other words libpam-mount can do only things the user can do, nothing more.

So, any suggestions?

Putting a user entry in fstab should do it. Please tell me how this works. Note that other filesystems (ncp, smb) have user-callable mount binaries like smbmount or ncpmount. There seems nothing like this for loopback mounts :/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.