1

I have a Windows File Share server and want to mount those CIFS in Linux server using PKI authentication. This is the command to mount Windows shares in Linux using username & password:

mount.cifs //HPSERVER/WindowsFS-bup/ /home/maxg/bmsOnSrvr --v -o user=linux,pass=****

Any idea or suggestions are appreciated.

0

As far as I know, SMB - the Windows File Share protocol - does not support PKI authentication directly, but does support Kerberos authentication.

So if the Windows File Share server is a member of an Active Directory domain, and you can arrange some way to use PKI authentication to get a Kerberos authentication ticket, you could use that (with the sec=krb5 or sec=krb5i option for mount.cifs) to mount the share. This seems to be possible, but rather complicated.

The first step would be to use pkinit (packaged as krb5-pkinit in some distributions) to get an initial Kerberos authentication ticket using PKI authentication. Once the user running the mount.cifs command has a valid krbtgt ticket for the Windows domain, mount.cifs can automatically request a further cifs/servername@DOMAIN.NAME ticket when sec=krb5[i] mount option is used.

This looks like a reasonably detailed description of such a setup: https://scriptech.io/linux-enable-smartcard-authentication-against-active-directory-and-generate-tgt-using-pkinit/

  • Thank you telcoM, your support is appreciated very much. My environment is now configured to accept PKI authentication. Here is the command, to mount the Windows shares(haven't run this command, my assumption is that it should allow domains users already authenticated to access their assigned directory from an application server). //mydomain/share /mnt/myshare smbfs rw,auto,multiuser,mfsymlinks,vers=3.1,sec=krb5,credentials=/root/creds 0 0 – mottycruz Oct 10 at 14:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.