2

I'm using pam_mount to automatically mount SMB/CIFS shares on login of a user and this works so far, but when someone authenticates without a password (via ssh-key) the mount fails because there is no password to pass to the mount programm. This will lead to a Permission denied error and will count as a failed authentication attempt. The problem is that user accounts are locked after several failed authentication attempts. Therefore if you use a ssh-key you will lock yourself out after some time.

Is there a way to tell PAM to not try to mount something if there is no password provided?

I found on their mailing list that an option soft_try_pass should do the trick (https://sourceforge.net/p/pam-mount/mailman/message/19574581/) but this option is not available anymore.

This is on Ubuntu 18.04 with libpam-mount version 2.16-3ubuntu0.1.

1

We had the same problem with our Debian clients in an Active Directory environment. To indicate that the authentication process succeeds through a password, you could set an environment variable and then conditionally mount on that variable during session setup.

Create a modified version of the pam mount config in /usr/share/pam-configs/libpam-mount-pw-only:

Name: Mount volumes for user (pw auth only)
Default: yes
Priority: 128
Auth-Type: Additional
Auth:
        [success=ok default=2]          pam_exec.so /bin/true
        optional                        pam_env.so envfile=/etc/default/pam-authenticate
        optional                        pam_mount.so
Session-Interactive-Only: yes
Session-Type: Additional
Session:
        [success=ok default=1]          pam_exec.so quiet /usr/bin/printenv PAM_AUTHENTICATE
        optional                        pam_mount.so
Password-Type: Additional
Password:
        optional                        pam_mount.so disable_interactive

Then create the environment file echo 'PAM_AUTHENTICATE=TRUE' > /etc/default/pam-authenticate and run pam-auth-update to activate the modified configuration (and deactivate the original configuration).

If a user logs in using ssh keys, you will see pam_exec(sshd:session): /usr/bin/printenv failed: exit code 1 (i.e. PAM_AUTHENTICATE not set) in /var/log/auth.log instead of the failed mount attempt.


Note: sshd will still call pam_setcred() and parse the auth stack if ssh keys are used. However, pam_exec.so will only be executed for pam_authenticate() (see pam_exec - call an external command) so that we can make the distinction here for a key-based authentication.

This is only a workaround. I would prefer a volume-specific option for pam_mount.conf.xml to indicate that no attempt should be performed to mount the volume without a password.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.