AutoFS for mouting Samba share with Kerberos Ticket

Question

I've setup a Samba AD on Debian Stretch. Another stretch client node is able to authenticate using AD credentials.

The domain user has limited rights on the client node, meaning he can't mount anything on the client.

On client, I have tested two things:

1. Mounting using password:

   # mount -t cifs \\\\fileserver.my.org\\share /mnt -o user=domainUser1

   I'm then asked domain password for domainUser1. Afterwards, the share is mounted by root.

2. Mounting using Kerberos ticket:

   # kinit domainUser1

   # mount -t cifs \\\\fileserver.my.org\\share /mnt -o sec=krb5

   This way I can mount the share if my current session has kerberos ticket (verified by klist).

Everything works find for manual mounting. The problem starts once I try to use AutoFS to mount share.

/etc/auto.master reads:

+dir:/etc/auto.master.d

+auto.master

/cifs /etc/auto.cifs

And /etc/auto.cifs reads:

Share -fstype=cifs,multiuser,cruid=${UID},sec=krb5 ://fileserver.my.org/share

From what I learnt about AutoFS in the last hour, this should work. But for some reason, /cifs/ folder is always empty. I tried both /var/log/messages and /var/log/syslog, but nothing noteworthy found in logs.

Answer 1

Debugging AutoFS

To debug autofs stop the service and run it on the command line:

sudo service autofs stop
sudo automount -f -d

Or turn on Debug Logging

Edit /etc/autofs.conf and set logging to "debug" or "verbose":

logging = "debug"

Play with this..But actually I had enough details leaving it as the default (ie comment out the line)

Check Kerberos ticket filename is correct

This is what was causing us headaches. For ages AutoFS wouldn't run in Kubuntu 18.04 until we corrected the filename of the generated Kerberos key file. If you look in daemon.log check that the file it is searching for has the same name as the one you can see in /tmp/krb*.

Here is what it looks like in daemon.log and you can see what the expacted filename is:

May 14 17:08:29 computer123 cifs.upcall: get_existing_cc: default ccache is FILE:/tmp/krb5cc_12345678

I'm pretty sure the above was with the default logging option, ie logging line commented out in /etc/autofs.conf. In fact one of the supposedly detailed options didn't show it..(?!)

Solution - we had to edit /etc/sssd/sssd.conf and add the following under [domain/yourAD_ServerName]

krb5_ccname_template=FILE:%d/krb5cc_%U

This tells sssd to make kerboros tickets with the filename expected by AutoFS. I had to reboot before the changes took effect (yes, I tried restarting sssd-secrets, sssd, autofs).