Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

(crosspost from SF, where I wasn't getting much joy)

I have a CentOS 6.2 box up and running and have configured autofs to automount Windows shares under a /mydomain folder, using various howtos on the internet. Specifically, I have three files:

/etc/auto.master

# ...
/mydomain   /etc/auto.mydomain --timeout=60
# ...

/etc/auto.mydomain

* -fstype=autofs,-DSERVER=& file:/etc/auto.mydomain.sub

/etc/auto.mydomain.sub

* -fstype=cifs,uid=${UID},gid=${EUID},credentials=${HOME}/.smb/mydomain ://${SERVER}/&

This works and allows each user to specify their own credentials in a file under their home directory.

However, the mounts they create are then available to everyone, with the original user's credentials, until the timeout is reached. This is less than ideal, so I've been looking at trying to do one of the following:

  1. Configure autofs so that the mounts are local to each user but under the same path, so they can each simultaneously access /mydomain/server1 with their own credentials
  2. Configure autofs so that the mount points are under each users' home folder, so they can each simultaneously access ~/mydomain/server1 with their own credentials
  3. Configure autofs so that the mounts are under a user-named folder, so they can simultaneously access /mydomain/$USER/server1 with their own credentials (but I would also need to ensure that /mydomain/$USER is 0700 to the given $USER)

So far, I can't see any way of doing #1, but for #2 or #3, I've tried changing the entry in /etc/auto.master so that the key is either ${HOME}/mydomain or /mydomain/${USER}, but neither have worked (the first showed no matching entry in /var/log/messages and the second did not appear to do the variable substitution).

Am I missing something obvious?

(PS: Bonus props if you can provide a way to avoid the need for a plain-text credentials file -- maybe a straight prompt for username/domain/password, or maybe even some kerberos magic?)

(PPS: I have looked briefly at smbnetfs, but I couldn't get it to configure/make -- it asks for fuse >= 2.6 even though I have v2.8.3 according to fusermount --version -- and I couldn't find a released version for yum install)

(PPPS: I also briefly looked at the supplied /etc/auto.smb but it looked like it would suffer the same sharing issues?)

share|improve this question
add comment

1 Answer 1

up vote 2 down vote accepted

I've done a lot of work with autofs and mounting a variety of different types of resources using it. You can check out the man page for autofs which does answer some of your questions if you can keep straight that when they're referring to $USER in the documentation, they're referring to the user that's running the autofs daemon. These are the variables that you get by default:

Variable Substitution

The following special variables will be substituted in the key and location fields of an automounter map if prefixed with $ as customary from shell scripts (Curly braces can be used to separate the field name):
ARCH    Architecture (uname -m)
CPU    Processor Type
HOST    Hostname (uname -n)
OSNAME    Operating System (uname -s)
OSREL    Release of OS (uname -r)
OSVERS    Version of OS (uname -v)
autofs provides additional variables that are set based on the user requesting the mount:

USER    The user login name
UID    The user login ID
GROUP    The user group name
GID    The user group ID
HOME    The user home directory
HOST    Hostname (uname -n)
Additional entries can be defined with the -Dvariable=Value map-option to automount(8).

You'd probably be tempted to use the -DUSER=$USER but this will only set $USER inside the autofs map file to the user that started the autofs daemon. The daemon is usually owned by a user such as root or a chrooted user specifically setup for autofs.

NOTE #1: a autofs file is comprised of a key and a value. The variables are only allowed for use within the value portion of a entry.

NOTE #2: If the -D=... switch does not override a built-in variable then $USER or $UID would contain the value of the person's $USER & $UID that is accessing the mount.

Limiting access to the CIFS share

Regarding your question of how to limit access to a CIFS mount, I don't see a way to accomplish this with autofs.

The credentials used to mount a CIFS share are used throughout the duration that the share is mounted. In effect, autofs, running it's daemon automount as say root, is "equivalent" to the credentials of the CIFS user.

This isn't what I would consider typical behavior for autofs and is a by-product of using mount.cifs. Typical autofs behavior would respect the permissions on the other end of the mount, whereas with mount.cifs it does not.

Bottom-line

I think you're out of luck accomplishing your setup using autofs. I think you're going to have to use fuse if you truly want each user to be accessing CIFS shares using their own credentials.

share|improve this answer
    
Thanks for this. Given autofs provides additional variables that are set based on the user requesting the mount, does that not mean $USER is already understood by autofs to be the guy who just cd'd into the path? Same with $HOME, I'd have thought. Is that the bit I am misunderstanding? Could it be more that the variable substitution cannot take place in the path part of the config file, only in the response part? So I can automount with config: /mydomain /etc/auto.mydomain --timeout=60 but I can't with config: $HOME/mydomain /etc/auto.mydomain --timeout=60? –  jimbobmcgee Jan 8 '13 at 12:58
    
One other approach you can take is that the map files can be scripts, so you can have a program/script generate the output as long as it conforms to the key & value syntax. Here's an example: ubuntuforums.org/showthread.php?t=2036409 –  slm Jan 8 '13 at 14:37
    
Yes my understanding is that those variables can only be used on the right side (the value) of the auto map files. The left side being the key. I've added additional notes to my answer to try and clear up what I was saying regarding the variables. –  slm Jan 8 '13 at 14:44
    
This is a matter of clarity in documentation then, I guess: the man line The following special variables will be substituted in the *key and location fields* of an automounter map if prefixed does not apply to the per-user variables that follow the man line autofs provides additional variables that are set based on the user requesting the mount. The script approach might be interesting, though. I'll see if I can wrap my head around coercing the logic into a working script... –  jimbobmcgee Jan 9 '13 at 16:35
    
Agreed. Other than FUSE, I think you're only other option will be the script for getting more elaborate setups. –  slm Jan 9 '13 at 16:45
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.