1

I have a Windows File Share server and want to mount those CIFS in Linux server using PKI authentication. This is the command to mount Windows shares in Linux using username & password:

mount.cifs //HPSERVER/WindowsFS-bup/ /home/maxg/bmsOnSrvr --v -o user=linux,pass=****

Any idea or suggestions are appreciated.

0

1 Answer 1

1

As far as I know, SMB - the Windows File Share protocol - does not support PKI authentication directly, but does support Kerberos authentication.

So if the Windows File Share server is a member of an Active Directory domain, and you can arrange some way to use PKI authentication to get a Kerberos authentication ticket, you could use that (with the sec=krb5 or sec=krb5i option for mount.cifs) to mount the share. This seems to be possible, but rather complicated.

The first step would be to use pkinit (packaged as krb5-pkinit in some distributions) to get an initial Kerberos authentication ticket using PKI authentication. Once the user running the mount.cifs command has a valid krbtgt ticket for the Windows domain, mount.cifs can automatically request a further cifs/[email protected] ticket when sec=krb5[i] mount option is used.

This looks like a reasonably detailed description of such a setup: Enable Smartcard Authentication Against Active Directory and generate TGT using PKINIT.

1
  • Thank you telcoM, your support is appreciated very much. My environment is now configured to accept PKI authentication. Here is the command, to mount the Windows shares(haven't run this command, my assumption is that it should allow domains users already authenticated to access their assigned directory from an application server). //mydomain/share /mnt/myshare smbfs rw,auto,multiuser,mfsymlinks,vers=3.1,sec=krb5,credentials=/root/creds 0 0
    – mottycruz
    Oct 10, 2019 at 14:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .