20

I want to mount a password-protected SMB share (served by a Windows machine). The share is protected by a user name and password, and I may not write the password in a file, I want to be prompted for the password at mount time.

I need a solution that works even for when the user on the client machine does not have any administrative privileges, so whatever method is used to mount the share must not allow him to get root permissions. The initial installation can be done as root. Users must be able to specify arbitrary server names. My immediate need is with Ubuntu 12.04, but the wider applicable a solution is the better.

The client is headless, so I'm looking for a command-line tool.

What I tried:

  • mount.cifs: while it can be made setuid root, its authors do not consider it secure. Running it under sudo has the same problem.
  • smbnetfs, fusesmb: I couldn't convince either of them to prompt me for a password.
  • Nautilus and gvfs: gvfs-mount smb://servername/sharename fails with Error mounting location: volume doesn't implement mount.

How can I mount a Samba share from the command line, as a non-root user, with a password prompt?

Improve this question
1
  • 1
    One of the lead devs seems to have loosened their stance on the setuid problems. Excerpt: "The code has been substantially reworked and should be far safer than it was previously. It does privilege separation now such that the bulk of the mount process is performed as an unprivileged user, and if linked against the right libs, with capabilities pruned to the minimum. At this point, I'd say it's safe enough that we no longer need to restrict it from being installed setuid root." source: lists.samba.org/archive/samba/2010-April/154935.html Figured I should point it out.
    – Tim
    Jul 27 '12 at 17:13
23

“Error mounting location: volume doesn't implement mount” apparently translates to “I need D-Bus but it isn't available”. (Thanks to venturax's guru colleague for this information.) Within an SSH session, I can use gvfs-mount provided that dbus-daemon is launched first and the environment variable DBUS_SESSION_BUS_ADDRESS is set.

export $(dbus-launch)
gvfs-mount smb://workgroupname\;username@hostname/sharename
# Type password
ls ~/.gvfs/'sharename on hostname'

gvfs-mount and other GVFS utilities must all talk to the same D-Bus session. Hence, if you use multiple SSH sessions or otherwise use mounts across login sessions, you must:

  • start D-Bus the first time it is needed, at the latest;
  • take care not to let D-Bus end with the session, as long as there are mounted GVFS filesystems;
  • reuse the existing D-Bus session at login time if there is one.

See Reuse D-Bus sessions across login sessions for that.

Improve this answer
1
  • 1
    This also applies to gio mount in recent ubuntu versions.
    – jnas
    Aug 24 '18 at 13:03
1

SMBNetFS uses Gnome-keyring by default. Any passwords entered and saved in Gnome-keyring while browsing Samba shares in Nautilus should be used automatically. So if storing passwords in Gnome-keyring is OK, SMBNetFS is more convenient. It automatically mounts the entire network neighbourhood. This information is from the sample SMBNetFS config file, but I haven't tested it since I don't use Gnome.

Regarding the use of the Gnome keyring without X11, see use of gnome-keyring-daemon without X.

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.