21

Data

  • I want operator users on this machine to mount their own cifs shares
  • The sudoers file already contains the /bin/mount -t cifs //*/* /media/* -o username=* command for all operators
  • I want the users to mount a cifs share through a script typing the password only once, not twice.
  • The sudo password and the cifs password are identical.

What I already have

This script works:

#!/bin/bash
sudo 'mount -t cifs //192.168.1.1/home /media/$USER/home -o username=$USER'

...but it requires the users to type the same password twice!

  • Once for sudo
  • Once for the mount itself

This would also work:

#!/bin/bash
echo -n Password: 
read -s szPassword
echo $szPassword | sudo -S sh -c 'echo $szPassword | mount -t cifs //192.168.1.1/home /media/$USER/home -o username=$USER'

...but this would require me to allow all operator users to be able to sudo sh (major security problem)

Question

How to mount a cifs share in bash¹ without putting sh in the sudoers file nor creating a permanent/temporary file???

Note 1: no python, perl, C, Go, ... please?
Note 2: I know I can just remove the password through the sudoers file, but I'm trying to tighten security, not loosen it, without giving up convenience...

  • 2
    How about printf "%s\n" "$szPassword" "$szPassword" | sudo -S mount -t cifs / ...? – muru Dec 20 '15 at 14:48
  • Trying that now! @Muru – Fabby Dec 20 '15 at 15:03
24

You should instead make the user do the call of using sudo as sudo script. just check if the script is being run as root, if not ask for it

if [[ $EUID -ne 0 ]]; then
   echo "This script must be run as root, use sudo "$0" instead" 1>&2
   exit 1
fi

Don't try to capture the password of your users.

  • 1
    Perhaps I'm missing something, but can you explain how this reduces the number of password prompts from two to one? Otherwise I don't see how this answers the question. – Oliphaunt Dec 21 '15 at 11:36
  • @Oliphaunt I don't see two password prompts, can you explain that? Also, this answer is not what OP wants, but what it needs. Is clean and proper solution when you need to run commands as root, and how other utilities do (check if root, otherwise bail out) – Braiam Dec 21 '15 at 14:08
  • 1
    The OP's problem (as I understand it) is that the user is prompted for their password by sudo and then (upon succesfully authenticating) again by mount. In their use case, these passwords are identical so I can see why the OP would like the user to only have to enter this password once. I don't believe your solution helps with this. I do agree that one shouldn't capture passwords. – Oliphaunt Dec 21 '15 at 14:19
  • Thanks, but I might have oversimplified the question a bit: It is a script already, already contains that test (except the 1>&2), is in the autostart and it used to be just one cifs share, but now it's three, so really one password is needed. (It already contains that test in case someone else, not member of the operators group, tries to run it) – Fabby Dec 21 '15 at 17:40
  • @Fabby I still think you are approaching the problem incorrectly. For these cases there are helper to "remember" the password of a CIFS/SMB share securely (editing ~/.smbcredentials for example), and even without the need of sudo (if you use gvfs, umount or polkit). – Braiam Dec 21 '15 at 18:10
7

I'm dumb!

The following script:

#!/bin/bash
read -p "Password: " -s szPassword
printf "%s\n" "$szPassword" | sudo --stdin mount -t cifs //192.168.1.1/home /media/$USER/home -o username=$USER,password="$szPassword"

just works and:

  1. Doesn't create any files containing passwords
  2. Allows the user to type only one password for multiple shares (including Windows ones)
  3. Has no need for extra privileges to be granted. :-)
  • 1
    1 question: does that echo the command into the process list? – Rinzwind Dec 20 '15 at 15:40
  • 3
    @Rinzwind as a built-in, it shouldn't in bash or zsh. The mount command could, though. – muru Dec 20 '15 at 16:06
  • <<< could also be used instead of printf , but better approach would be to drop read altogether and just use sudo --stdin all by itself. Something like $ printf "Type out your password\n" && sudo --stdin apt-get update User still can type in the sudo password. and that won't put it into process list. But of course there's infinite amount of possible other security issues, like keyloggers, potential vulnerabilities in sudo, and blah, and blah, and blah into infinity – Sergiy Kolodyazhnyy Jul 13 '17 at 7:55
  • @SergiyKolodyazhnyy: Feel free to edit, man! – Fabby Jul 15 '17 at 20:46
3

Require no sudo password for executing this command; the password prompt for mount remains.

In sudoers, include something like

ALL        ALL = NOPASSWD: /bin/mount -t cifs //*/* /media/* -o username=*

After including this, sudo will no longer ask for a password for this specific command; the user still needs to provide a password to the mount command.

Note: I took the command verbatim from what you included in the question; I didn't check whether its wildcards would allow for users to do something nasty. Read the sudoers manpage for examples of nastiness. In particular, note that this line in sudoers allows the user to add any number of -o switches or other arguments to mount. You may want to rethink your approach, e.g. by adding a script such as @Braiam proposes and allow running that through sudo without extra authentication. The script then ensures that users can only run the specific form of mount that you want them to run.

Also, instead of allowing this for all users, you could also limit this to members of a certain group, e.g. you could create a group cifsmount and then have

%cifsmount ALL = NOPASSWD: /bin/mount -t cifs //*/* /media/* -o username=*
  • @Fabby Sorry, but what's so dangerous about this? Also I may be detecting a hint of sarcasm, not sure. – Oliphaunt Dec 20 '15 at 20:50
  • well, even if sudo doesn't require a password, mount might still require a password. The /etc/sudoers file could be used to just make sudo not require a password. That wouldn't affect whether mount asks for a password. If a person failed to mount, then sudo would just end up running a command that fails, which is likely not a problem. – TOOGAM Dec 21 '15 at 8:49
  • @TOOGAM That was my intention. One password instead of two. – Oliphaunt Dec 21 '15 at 9:09
  • My intention is to keep one "operator" group in the sudoers file so if an operator tries to mount its own stuff, they still have to type a password, but to mount the "standard" operator mounts, they only have to type the password once instead of 5 times... But your solution might work for others, so upvoted... (and original comments removed) – Fabby Dec 21 '15 at 17:07
1

A general solution to these issues is to put the following preamble at the top of your sudo requiring scripts:

#!/bin/bash
case $EUID in
   0) : cool we are already root - fall through ;;
   *) # not root, become root for the rest of this session
      # (and ask for the sudo password only once)
      sudo $0 "$@" ;;
esac
# now the present process is effective-UID  (root)
# so there's no need to put sudo in front of commands

any more commands here will run as superuser ...

Obviously, this has a downside in that if some commands in the script don't require sudo to run, there's an unnecessary elevation of privileges here.

Anyway, thought I would share this little tip. The nicest thing about it, is that if you're already effective-uid root (e.g. if you already called it under sudo) it gracefully does the right thing. Also giving an error and forcing you to retype/rerun (with sudo) is less friendly.

You may also want to check out the timestamp_timeout variable in man 5 sudoers which tells sudo to remember user credentials for a limited number of minutes (and can be fractional).

  • I oversimplified the script to get an easy answer: the script already contains: #test if root: if not: bail out if [[ $EUID -ne 0 ]]; then echo "This script must be run as root, use sudo "$0" instead" 1>&2 exit 1 fi The point is that it also contains multiple mounts all with the same password (again: removed), but thanks anyway... – Fabby Dec 26 '15 at 8:18
  • 1
    The point is that the solution above would require only one typing of the password (for sudo). It shouldn't require any other. Plus it is a general (and more elegant than giving an error and having to retype the command with sudo) for all similar issues, even when they require multiple (more than two) privileged commands. – arielf Dec 26 '15 at 9:19
  • It should but it doesn't! ;-) That's because each cifs share mount requires a password as well. (as it can be different from the Ubuntu password, but in this case isn't as the operators keep their Windows and Ubuntu passwords synchronised) – Fabby Dec 26 '15 at 9:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.