Setup for mounting kerberized nfs home directory - gssd not finding valid kerberos ticket

Question

Our home directories are exported via kerberized nfs, so the user needs a valid kerberos ticket to be able to mount its home. This setup works fine with our existing clients & server.

Now we want to add some 11.10 client and thus set up ldap & kerberos together with pam_mount. The ldap authentication works and users can login via ssh, however their homes can not be mounted.

When pam_mount is configured to mount as root, gssd does not find a valid kerberos ticket and the mount fails.

Nov 22 17:34:26 zelda rpc.gssd[929]: handle_gssd_upcall: 'mech=krb5 uid=0 enctypes=18,17,16,23,3,1,2 '
Nov 22 17:34:26 zelda rpc.gssd[929]: handling krb5 upcall (/var/lib/nfs/rpc_pipefs/nfs/clnt2)
Nov 22 17:34:26 zelda rpc.gssd[929]: process_krb5_upcall: service is '<null>'
Nov 22 17:34:26 zelda rpc.gssd[929]: getting credentials for client with uid 0 for server purple.physcip.uni-stuttgart.de
Nov 22 17:34:26 zelda rpc.gssd[929]: CC file '/tmp/krb5cc_65678_Ku2226' being considered, with preferred realm 'PURPLE.PHYSCIP.UNI-STUTTGART.DE'
Nov 22 17:34:26 zelda rpc.gssd[929]: CC file '/tmp/krb5cc_65678_Ku2226' owned by 65678, not 0
Nov 22 17:34:26 zelda rpc.gssd[929]: WARNING: Failed to create krb5 context for user with uid 0 for server purple.physcip.uni-stuttgart.de
Nov 22 17:34:26 zelda rpc.gssd[929]: doing error downfall

When pam_mount is on the other hand configured with the noroot=1 option, then it cannot mount the volume at all.

Nov 22 17:33:58 zelda sshd[2226]: pam_krb5(sshd:auth): user phy65678 authenticated as [email protected]
Nov 22 17:33:58 zelda sshd[2226]: Accepted password for phy65678 from 129.69.74.20 port 51875 ssh2
Nov 22 17:33:58 zelda sshd[2226]: pam_unix(sshd:session): session opened for user phy65678 by (uid=0)
Nov 22 17:33:58 zelda sshd[2226]: pam_mount(mount.c:69): Messages from underlying mount program:
Nov 22 17:33:58 zelda sshd[2226]: pam_mount(mount.c:73): mount: only root can do that
Nov 22 17:33:58 zelda sshd[2226]: pam_mount(pam_mount.c:521): mount of /Volumes/home/phy65678 failed

So how can we allow users of a specific group to perform nfs mounts? If this does not work, can we make pam_mount use root but pass the correct uid?

Answer 1

See this thread:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=190267

If there is no "user" option in fstab, only root can mount volumes. There is some comment in mount.c on making the mount command executable by any user, but that was rejected by the maintainer (the comment says something about security implications, but is not more specific).

In contrast to the original upstream, the Debian version of libpam-mount executes mount commands with the user uid, not as root. Doing user-specified mounts as root is a security hole. Any user then could mount a volume to /usr or /tmp on login, or umount any other volume on logout.

Or in other words libpam-mount can do only things the user can do, nothing more.

So, any suggestions?

Putting a user entry in fstab should do it. Please tell me how this works. Note that other filesystems (ncp, smb) have user-callable mount binaries like smbmount or ncpmount. There seems nothing like this for loopback mounts :/