I'm trying to configure automounting of users home directories using pam_mount and sshfs (users are LDAP users on remote machine).

I configured pam_mount:

<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">
<debug enable="1" />
<mntoptions allow="nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other" />
<mntoptions require="nosuid,nodev" />
<logout wait="0" hup="0" term="0" kill="0" />
<mkmountpoint enable="1" remove="true" />
<volume fstype="fuse" path="sshfs#%(USER)@HOSTNAME:" mountpoint="~" ssh="1" options="reconnect,idmap=user,password_stdin,nonempty" />

When I'm trying to su to user I'm asked about password:

root@debian:~# su - pszubert
pam_mount(pam_mount.c:553): pam_mount 2.5: entering session stage
reenter password for pam_mount:
pam_mount(misc.c:38): Session open: (ruid/rgid=0/20001, e=0/20001)
pam_mount(mount.c:213): Mount info: globalconf, user=pszubert <volume fstype="fuse" server="(null)" path="sshfs#pszubert@HOST:" mountpoint="/home/pszubert" cipher="(null)" fskeypath="(null)" fskeycipher="(null)" fskeyhash="(null)" options="reconnect,idmap=user,password_stdin,nonempty" /> fstab=0 ssh=1
command: 'pmt-fd0ssh' 'mount.fuse' 'sshfs#pszubert@HOST:' '/home/pszubert' '-oreconnect,idmap=user,password_stdin,nonempty' 
pam_mount(spawn.c:108): setting uid to user pszubert
pam_mount(misc.c:38): set_myuid<post>: (ruid/rgid=20001/20001, e=20001/20001)
System plików  Typ bl.  1K B        użyte dostępne %uż. zamont. na
/dev/sda1     ext3     7867856    940236   6527956  13% /
tmpfs        tmpfs      192316         0    192316   0% /lib/init/rw
proc          proc           0         0         0   -  /proc
sysfs        sysfs           0         0         0   -  /sys
udev         tmpfs      187872       148    187724   1% /dev
tmpfs        tmpfs      192316         0    192316   0% /dev/shm
devpts      devpts           0         0         0   -  /dev/pts
fusectl    fusectl           0         0         0   -  /sys/fs/fuse/connections
pam_mount(pam_mount.c:521): mount of sshfs#pszubert@HOST: failed
command: 'pmvarrun' '-u' 'pszubert' '-o' '1' 
pam_mount(misc.c:38): set_myuid<pre>: (ruid/rgid=0/20001, e=0/20001)
pam_mount(misc.c:38): set_myuid<post>: (ruid/rgid=0/20001, e=0/20001)
pmvarrun(pmvarrun.c:248): parsed count value 0
pam_mount(pam_mount.c:440): pmvarrun says login count is 1
pam_mount(pam_mount.c:643): done opening session (ret=0)

In HOST auth.log there is info:

Mar 17 22:13:42 student sshd[17889]: Accepted password for pszubert from port 20264 ssh2
Mar 17 22:13:42 student sshd[17889]: pam_unix(sshd:session): session opened for user pszubert by (uid=0)
Mar 17 22:13:42 student sshd[17891]: subsystem request for sftp
Mar 17 22:13:42 student sshd[17891]: Received disconnect from XXXXXXXXXX: 11: disconnected by user
Mar 17 22:13:42 student sshd[17889]: pam_unix(sshd:session): session closed for user pszubert

What is weird when I'm logged in I can mount remote fs using sshfs pszubert@HOST: a/.

What's wrong?

I think that problem is with ~/.ssh on local machine. First problem was about known_hosts file, so I created global known_hosts in /etc/ssh/ssh_known_hosts. Now ~/.ssh is still created, but is empty even if I connect to remote host manually. I think that if I could prevent of creation ~/.ssh it would solve problem. Is there a way to disable it?


I solved problem.

First I created global known_hosts file in /etc/ssh/ssh_known_hosts.

Main problem was visible in this line of debug:

command: 'pmt-fd0ssh' 'mount.fuse' 'sshfs#pszubert@HOST:' '/home/pszubert' '-oreconnect,idmap=user,password_stdin,nonempty'

As we can see there is no space between -o and options.

Adding line:

<fusemount>mount.fuse %(VOLUME) %(MNTPT) -o %(OPTIONS)</fusemount>

to pam_mount config file (/etc/security/pam_mount.conf.xml) solved problem. Now mount.fuse is called in tis way this:

command: 'pmt-fd0ssh' 'mount.fuse' 'sshfs#pszubert@HOST:' '/home/pszubert' '-o' 'reconnect,nonempty'

Next important things are permissions to /dev/fuse and /usr/bin/fusermount. User should be in fuse group. In my case it wasn't possible because it is remote user so I changed permissions manually:

chmod o+x /usr/bin/fusermount
chmod o+rw /dev/fuse
|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.