0

Can anyone suggest a process that will allow a user to have their Windows network share mounted to a Linux directory after they are logged into the Linux machine via OpenLDAP? The current options I've thought of...

  1. Give each user the ability to mount directories - This doesn't work as I don't want to open the security vulnerability of overwriting other directories

  2. Create a smb credentials file and have a script in bash_profile mount the directory - This doesn't work as the user will still need to have mount permissions, and the user's AD passwords will be changing

...I tried using AutoFS, but when accessing the mounted directory, I'm never prompted to enter a password, and the directory doesn't show my user's folders.

AutoFS Example... File: auto.master

/mnt/files /etc/auto.sharedfs

File: auto.sharedfs

<user> -fstype=cifs,rw,username=<user> //network/path

Also, just for reference, the CIFS share can be mounted when running the mount command manually. Is there any other way someone has achieved this situation where a user authenticates over LDAP, and once logged in, can browse to their Windows network shares? Trying to accomplish this in either Fedora or Ubuntu.

  • LDAP is not a filesystem protocol. – RalfFriedl Jun 5 at 16:36
  • Sorry @RalfFriedl if what I said implied LDAP to be a filesystem protocol. I made an edit above to hopefully clarify. Basically what I'm wanting to have done is similar to how once you are logged into a Windows machine, you can UNC out to any NTFS share you have access to based on your login to the system. Is there a way once you have successfully authenticated over LDAP to login to the Linux machine, to mount the Windows shares with the Active Directory credentials you use to login over LDAP? Thanks – bluezfan8 Jun 5 at 18:07
  • There is Kerberos, and AD is basically LDAP combined with Kerberos, and there is automount, however I don't know how to combine them to mount arbitrary shares. – RalfFriedl Jun 5 at 19:24
  • If you use Kerberos for authentication (you can still use ldap for authorization, i.e. users, groups and who can log in) then you can set up an autofs mount that uses the user’s Kerberos ticket to mount the SMB volume, assuming it is also using the same domain or there’s a trust between them. AutoFS uses the “upcall” system for users to perform the mounts. – jsbillings Jun 9 at 2:45
  • Thanks! I'll take a look at Kerberos and see if I can't get something working. – bluezfan8 Jun 12 at 14:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.