I am attempting to setup a centralized home-directory server through sshfs and pam-mount.

Currently I am stuck at this point:

When attempting to mount the remote home directory sshfs just gets stuck:

d_inevitable@laptop:~$ sshfs -o nonempty,debug server: .
FUSE library version: 2.9.0
nullpath_ok: 0
nopath: 0
utime_omit_ok: 0

It freezes at this point.

This seems to be because the home directory includes ~/.ssh. So when I try sshfs -o nonempty server:.ssh .ssh the same thing happens.

I suppose fuse somehow initializes the mount, but then ssh needs something from it's config directory so it tries to read from it. Fuse will just block that read resulting in a deadlock.

What kind of stuff does sshfs need from ~/.ssh?

I have tried to remove all read/write permissions from ~/.ssh and then mounting on some other directory. That worked fine. The debug output only complained about writing to .ssh/known_hosts.

  • Using sshfs sounds like a bad idea offhand. Why aren't you using NFS?? – Chris S May 9 '13 at 18:03
  • @chriss for security reasons. It would be very difficult to satisfy the same requirements with NFS. – d_inevitable May 9 '13 at 18:23
  • @chriss actually the main reason is this: serverfault.com/questions/200759/… – d_inevitable May 9 '13 at 22:05
  • Oh, that's a strange limitation, I guess I'm used to -nix systems that make sense. – Chris S May 10 '13 at 1:50
  • @chriss I suppose I could convert ecryptfs to a truecrypt volume and then krb5p NFS should work, but that would be a very long and bumpy road (resize partitions, transfer data, key management, etc). – d_inevitable May 10 '13 at 6:34

You are right, fuse initiates the mount first, then initiates the ssh process. This causes a problem for you, since by default ssh reads ~/.ssh/ssh_config, ~/.ssh/known_config, ~/.ssh/id_* files from user home. This behavior can be changed:

  1. ~/.ssh/ssh_config is the default per-user configuration file. An alternative per-user configuration file can be specified using -F option, or use -F /dev/null to specify no per-user configuration file.
  2. ~/.ssh/known_config is used to store and check host keys. You can use -o UserKnownHostsFile=/dev/null, and either manually add the host key to /etc/ssh/ssh_known_hosts or use -o StrictHostKeyChecking=no.
  3. ~/.ssh/id_* files are identity files by default used for client authentication. If you want to authenticate using an identity file, you need to keep it outside the home directory and use -o IdentitiesOnly=yes -o IdentityFile=<path to private key>. Or else you can authenticate interactively if you use -o IdentitiesOnly=yes -o IdentityFile=/dev/null -o PubkeyAuthentication=no.

For example to mount home using sshfs, authenticating using password, without host key checking, run

sshfs user@server: ~/ -o nonempty -F /dev/null -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o IdentitiesOnly=yes -o IdentityFile=/dev/null -o PubkeyAuthentication=no
  • Per the OP, the user wants to combine this with pam_mount. This can be done by following your instructions, and adding the above to /etc/security/pam_mount.conf.xml like so: ` <fusemount>mount.fuse %(VOLUME) %(MNTPT) -F /dev/null -o UserKnownHostsFile=/dev/null -o IdentitiesOnly=yes -o IdentityFile=/dev/null -o %(OPTIONS)</fusemount> <volume fstype="fuse" path="sshfs#%(USER)@localhost:/home/%(USER)" mountpoint="~" ssh="1" options="reconnect,idmap=user,password_stdin,nonempty" /> ` – Luciano Oct 6 '19 at 15:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.