2

I've setup a Samba AD on Debian Stretch. Another stretch client node is able to authenticate using AD credentials.

The domain user has limited rights on the client node, meaning he can't mount anything on the client.

On client, I have tested two things:

  1. Mounting using password:

    # mount -t cifs \\\\fileserver.my.org\\share /mnt -o user=domainUser1

    I'm then asked domain password for domainUser1. Afterwards, the share is mounted by root.

  2. Mounting using Kerberos ticket:

    # kinit domainUser1

    # mount -t cifs \\\\fileserver.my.org\\share /mnt -o sec=krb5

    This way I can mount the share if my current session has kerberos ticket (verified by klist).

Everything works find for manual mounting. The problem starts once I try to use AutoFS to mount share.

/etc/auto.master reads:

+dir:/etc/auto.master.d

+auto.master

/cifs /etc/auto.cifs

And /etc/auto.cifs reads:

Share -fstype=cifs,multiuser,cruid=${UID},sec=krb5 ://fileserver.my.org/share

From what I learnt about AutoFS in the last hour, this should work. But for some reason, /cifs/ folder is always empty. I tried both /var/log/messages and /var/log/syslog, but nothing noteworthy found in logs.

Improve this question
2
  • Have you tried explicitly accessing the "Share" mountpoint: ls -l /cifs/Share? Autofs only mounts on demand. /cifs will remain empty until something tries to access /cifs/Share, which in turn will trigger mounting the share. If you want to see which shares are available before accessing them, you may need a script similar to auto.net (typically a script included in the autofs package). This could - for example - list all shares on a host by dynamically generating the list map by polling the server.
    – sborsky
    Mar 4, 2019 at 19:36
  • I had a similar problem the solution to which might be useful to you. Mounting cifs with PAM
    – Stephen7337
    May 2, 2019 at 14:09

1 Answer 1

Reset to default
2

Debugging AutoFS

To debug autofs stop the service and run it on the command line:

sudo service autofs stop
sudo automount -f -d

Or turn on Debug Logging

Edit /etc/autofs.conf and set logging to "debug" or "verbose":

logging = "debug"

Play with this..But actually I had enough details leaving it as the default (ie comment out the line)

Check Kerberos ticket filename is correct

This is what was causing us headaches. For ages AutoFS wouldn't run in Kubuntu 18.04 until we corrected the filename of the generated Kerberos key file. If you look in daemon.log check that the file it is searching for has the same name as the one you can see in /tmp/krb*.

Here is what it looks like in daemon.log and you can see what the expacted filename is:

May 14 17:08:29 computer123 cifs.upcall: get_existing_cc: default ccache is FILE:/tmp/krb5cc_12345678

I'm pretty sure the above was with the default logging option, ie logging line commented out in /etc/autofs.conf. In fact one of the supposedly detailed options didn't show it..(?!)

Solution - we had to edit /etc/sssd/sssd.conf and add the following under [domain/yourAD_ServerName]

krb5_ccname_template=FILE:%d/krb5cc_%U

This tells sssd to make kerboros tickets with the filename expected by AutoFS. I had to reboot before the changes took effect (yes, I tried restarting sssd-secrets, sssd, autofs).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.