2

I have a directory in my Debian home: /home/myuser/pchome/ which i want to use as a mount point for a remote cifs filesystem. So i have a bash script, which is run on every myuser login. This script contains the command:

mount -t cifs //192.168.1.2/myuser -o username=myuser,password=mypassword,uid=1000,gid=1000 /home/myuser/pchome

The command works like a charm using itself in a console. But, the problem is that mount requires sudo and password introduction (or be run with root privileges).

sudoers

First approach i thought about is configure the sudoers to allow the use of mount for myuser. Something like:

myuser ALL=(ALL)    NOPASSWD: /bin/mount, /bin/umount

The problem with that, is that myuser could use mount without limits, even for mounting filesystems on /etc, for example. I'm not interested in allowing myuser the use of mount command freely.

fstab

Second approach i thought about, is using fstab to allow the mount. I did not test it, but i think that, with this solution, both the mount point and filesystem to mount could be fixed, and no other mount could be done. But, every user could perform the mount (if using the "user" option for fstab line).

From my point of view, none of the two ideas is correct enought, so i would like if any of you knows the valid approach to that problem. I only want to be allowed to mount a public remote filesystem using a mount point inside my home without any concern about security, passwords or exposing the system to malicious mounts. It should be easier, since the mount point is inside my own home.

Thanks in advance.

1

One possibility is to save the mounting command as a script (modifiable only by root) AND define sudo privileges for the script.

/home/bin/mymount:

#!/bin/sh
mount -t cifs //192.168.1.2/myuser -o username=myuser,password=mypassword,uid=1000,gid=1000 /home/myuser/pchome

sudoers:

myuser ALL=(ALL)    NOPASSWD: /home/bin/mymount # and maybe , /home/bin/myumount

As a sidenote, you may also want to save that CIFS password in a credentials file.


You can give the permission to various users by defining an alias or by giving the permission to a group.

Using an alias:

User_Alias CIFSUSERS = myuser, user2, user3 #, more users
CIFSUSERS ALL=(ALL)    NOPASSWD: /home/bin/mymount # ...

Or giving permission to a group, e.g. group floppy:

%floppy ALL=(ALL)    NOPASSWD: /home/bin/mymount # ...
  • It's a good alternative. Although it seems not very scalable (adding one line to sudoers per each user, for example), it's cleaner than giving full access to mount command. Thanks. – Alberto Jiménez Dec 28 '14 at 17:34
  • @AlbertoJiménez actually, the sudoers file is quite flexible. You don't need to add a new rule for every user. You can use user aliases or give permission to a group. I've updated my answer to show both possibilities. – outlyer Dec 28 '14 at 17:46
  • Again, thanks a lot, @outlyer. giving permission to a newly created group sounds very clean and simple. Incredibly, i didn't realize that i could use a group, although i'm currently using that option for sudo and dialer groups. – Alberto Jiménez Dec 29 '14 at 19:48
0

You can try autofs

In that way when user access the folder it will be automatically mounted.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.