22

Data

  • I want operator users on this machine to mount their own cifs shares
  • The sudoers file already contains the /bin/mount -t cifs //*/* /media/* -o username=* command for all operators
  • I want the users to mount a cifs share through a script typing the password only once, not twice.
  • The sudo password and the cifs password are identical.

What I already have

This script works:

#!/bin/bash
sudo 'mount -t cifs //192.168.1.1/home /media/$USER/home -o username=$USER'

...but it requires the users to type the same password twice!

  • Once for sudo
  • Once for the mount itself

This would also work:

#!/bin/bash
echo -n Password: 
read -s szPassword
echo $szPassword | sudo -S sh -c 'echo $szPassword | mount -t cifs //192.168.1.1/home /media/$USER/home -o username=$USER'

...but this would require me to allow all operator users to be able to sudo sh (major security problem)

Question

How to mount a cifs share in bash¹ without putting sh in the sudoers file nor creating a permanent/temporary file???

Note 1: no python, perl, C, Go, ... please?
Note 2: I know I can just remove the password through the sudoers file, but I'm trying to tighten security, not loosen it, without giving up convenience...

2
  • 2
    How about printf "%s\n" "$szPassword" "$szPassword" | sudo -S mount -t cifs / ...?
    – muru
    Dec 20, 2015 at 14:48
  • Trying that now! @Muru
    – Fabby
    Dec 20, 2015 at 15:03

4 Answers 4

27

You should instead make the user do the call of using sudo as sudo script. just check if the script is being run as root, if not ask for it

if [[ $EUID -ne 0 ]]; then
   echo "This script must be run as root, use sudo "$0" instead" 1>&2
   exit 1
fi

Don't try to capture the password of your users.

6
  • 1
    Perhaps I'm missing something, but can you explain how this reduces the number of password prompts from two to one? Otherwise I don't see how this answers the question.
    – Oliphaunt
    Dec 21, 2015 at 11:36
  • @Oliphaunt I don't see two password prompts, can you explain that? Also, this answer is not what OP wants, but what it needs. Is clean and proper solution when you need to run commands as root, and how other utilities do (check if root, otherwise bail out)
    – Braiam
    Dec 21, 2015 at 14:08
  • 1
    The OP's problem (as I understand it) is that the user is prompted for their password by sudo and then (upon succesfully authenticating) again by mount. In their use case, these passwords are identical so I can see why the OP would like the user to only have to enter this password once. I don't believe your solution helps with this. I do agree that one shouldn't capture passwords.
    – Oliphaunt
    Dec 21, 2015 at 14:19
  • Thanks, but I might have oversimplified the question a bit: It is a script already, already contains that test (except the 1>&2), is in the autostart and it used to be just one cifs share, but now it's three, so really one password is needed. (It already contains that test in case someone else, not member of the operators group, tries to run it)
    – Fabby
    Dec 21, 2015 at 17:40
  • @Fabby I still think you are approaching the problem incorrectly. For these cases there are helper to "remember" the password of a CIFS/SMB share securely (editing ~/.smbcredentials for example), and even without the need of sudo (if you use gvfs, umount or polkit).
    – Braiam
    Dec 21, 2015 at 18:10
10

I'm dumb!

The following script:

#!/bin/bash
read -p "Password: " -s szPassword
printf "%s\n" "$szPassword" | sudo --stdin mount -t cifs //192.168.1.1/home /media/$USER/home -o username=$USER,password="$szPassword"

just works and:

  1. Doesn't create any files containing passwords
  2. Allows the user to type only one password for multiple shares (including Windows ones)
  3. Has no need for extra privileges to be granted. :-)
4
  • 1
    1 question: does that echo the command into the process list?
    – Rinzwind
    Dec 20, 2015 at 15:40
  • 3
    @Rinzwind as a built-in, it shouldn't in bash or zsh. The mount command could, though.
    – muru
    Dec 20, 2015 at 16:06
  • <<< could also be used instead of printf , but better approach would be to drop read altogether and just use sudo --stdin all by itself. Something like $ printf "Type out your password\n" && sudo --stdin apt-get update User still can type in the sudo password. and that won't put it into process list. But of course there's infinite amount of possible other security issues, like keyloggers, potential vulnerabilities in sudo, and blah, and blah, and blah into infinity Jul 13, 2017 at 7:55
  • @SergiyKolodyazhnyy: Feel free to edit, man!
    – Fabby
    Jul 15, 2017 at 20:46
3

Require no sudo password for executing this command; the password prompt for mount remains.

In sudoers, include something like

ALL        ALL = NOPASSWD: /bin/mount -t cifs //*/* /media/* -o username=*

After including this, sudo will no longer ask for a password for this specific command; the user still needs to provide a password to the mount command.

Note: I took the command verbatim from what you included in the question; I didn't check whether its wildcards would allow for users to do something nasty. Read the sudoers manpage for examples of nastiness. In particular, note that this line in sudoers allows the user to add any number of -o switches or other arguments to mount. You may want to rethink your approach, e.g. by adding a script such as @Braiam proposes and allow running that through sudo without extra authentication. The script then ensures that users can only run the specific form of mount that you want them to run.

Also, instead of allowing this for all users, you could also limit this to members of a certain group, e.g. you could create a group cifsmount and then have

%cifsmount ALL = NOPASSWD: /bin/mount -t cifs //*/* /media/* -o username=*
4
  • @Fabby Sorry, but what's so dangerous about this? Also I may be detecting a hint of sarcasm, not sure.
    – Oliphaunt
    Dec 20, 2015 at 20:50
  • well, even if sudo doesn't require a password, mount might still require a password. The /etc/sudoers file could be used to just make sudo not require a password. That wouldn't affect whether mount asks for a password. If a person failed to mount, then sudo would just end up running a command that fails, which is likely not a problem.
    – TOOGAM
    Dec 21, 2015 at 8:49
  • @TOOGAM That was my intention. One password instead of two.
    – Oliphaunt
    Dec 21, 2015 at 9:09
  • My intention is to keep one "operator" group in the sudoers file so if an operator tries to mount its own stuff, they still have to type a password, but to mount the "standard" operator mounts, they only have to type the password once instead of 5 times... But your solution might work for others, so upvoted... (and original comments removed)
    – Fabby
    Dec 21, 2015 at 17:07
1

A general solution to these issues is to put the following preamble at the top of your sudo requiring scripts:

#!/bin/bash
case $EUID in
   0) : cool we are already root - fall through ;;
   *) # not root, become root for the rest of this session
      # (and ask for the sudo password only once)
      sudo $0 "$@" ;;
esac
# now the present process is effective-UID  (root)
# so there's no need to put sudo in front of commands

any more commands here will run as superuser ...

Obviously, this has a downside in that if some commands in the script don't require sudo to run, there's an unnecessary elevation of privileges here.

Anyway, thought I would share this little tip. The nicest thing about it, is that if you're already effective-uid root (e.g. if you already called it under sudo) it gracefully does the right thing. Also giving an error and forcing you to retype/rerun (with sudo) is less friendly.

You may also want to check out the timestamp_timeout variable in man 5 sudoers which tells sudo to remember user credentials for a limited number of minutes (and can be fractional).

3
  • I oversimplified the script to get an easy answer: the script already contains: #test if root: if not: bail out if [[ $EUID -ne 0 ]]; then echo "This script must be run as root, use sudo "$0" instead" 1>&2 exit 1 fi The point is that it also contains multiple mounts all with the same password (again: removed), but thanks anyway...
    – Fabby
    Dec 26, 2015 at 8:18
  • 1
    The point is that the solution above would require only one typing of the password (for sudo). It shouldn't require any other. Plus it is a general (and more elegant than giving an error and having to retype the command with sudo) for all similar issues, even when they require multiple (more than two) privileged commands.
    – arielf
    Dec 26, 2015 at 9:19
  • It should but it doesn't! ;-) That's because each cifs share mount requires a password as well. (as it can be different from the Ubuntu password, but in this case isn't as the operators keep their Windows and Ubuntu passwords synchronised)
    – Fabby
    Dec 26, 2015 at 9:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.