(crosspost from SF, where I wasn't getting much joy)

I have a CentOS 6.2 box up and running and have configured autofs to automount Windows shares under a /mydomain folder, using various howtos on the internet. Specifically, I have three files:


# ...
/mydomain   /etc/auto.mydomain --timeout=60
# ...


* -fstype=autofs,-DSERVER=& file:/etc/auto.mydomain.sub


* -fstype=cifs,uid=${UID},gid=${EUID},credentials=${HOME}/.smb/mydomain ://${SERVER}/&

This works and allows each user to specify their own credentials in a file under their home directory.

However, the mounts they create are then available to everyone, with the original user's credentials, until the timeout is reached. This is less than ideal, so I've been looking at trying to do one of the following:

  1. Configure autofs so that the mounts are local to each user but under the same path, so they can each simultaneously access /mydomain/server1 with their own credentials
  2. Configure autofs so that the mount points are under each users' home folder, so they can each simultaneously access ~/mydomain/server1 with their own credentials
  3. Configure autofs so that the mounts are under a user-named folder, so they can simultaneously access /mydomain/$USER/server1 with their own credentials (but I would also need to ensure that /mydomain/$USER is 0700 to the given $USER)

So far, I can't see any way of doing #1, but for #2 or #3, I've tried changing the entry in /etc/auto.master so that the key is either ${HOME}/mydomain or /mydomain/${USER}, but neither have worked (the first showed no matching entry in /var/log/messages and the second did not appear to do the variable substitution).

Am I missing something obvious?

(PS: Bonus props if you can provide a way to avoid the need for a plain-text credentials file -- maybe a straight prompt for username/domain/password, or maybe even some kerberos magic?)

(PPS: I have looked briefly at smbnetfs, but I couldn't get it to configure/make -- it asks for fuse >= 2.6 even though I have v2.8.3 according to fusermount --version -- and I couldn't find a released version for yum install)

(PPPS: I also briefly looked at the supplied /etc/auto.smb but it looked like it would suffer the same sharing issues?)

3 Answers 3


I've done a lot of work with autofs and mounting a variety of different types of resources using it. You can check out the man page for autofs which does answer some of your questions if you can keep straight that when they're referring to $USER in the documentation, they're referring to the user that's running the autofs daemon. These are the variables that you get by default:

Variable Substitution

The following special variables will be substituted in the key and location fields of an automounter map if prefixed with $ as customary from shell scripts (Curly braces can be used to separate the field name):
ARCH    Architecture (uname -m)
CPU    Processor Type
HOST    Hostname (uname -n)
OSNAME    Operating System (uname -s)
OSREL    Release of OS (uname -r)
OSVERS    Version of OS (uname -v)
autofs provides additional variables that are set based on the user requesting the mount:

USER    The user login name
UID    The user login ID
GROUP    The user group name
GID    The user group ID
HOME    The user home directory
HOST    Hostname (uname -n)
Additional entries can be defined with the -Dvariable=Value map-option to automount(8).

You'd probably be tempted to use the -DUSER=$USER but this will only set $USER inside the autofs map file to the user that started the autofs daemon. The daemon is usually owned by a user such as root or a chrooted user specifically setup for autofs.

NOTE #1: a autofs file is comprised of a key and a value. The variables are only allowed for use within the value portion of a entry.

NOTE #2: If the -D=... switch does not override a built-in variable then $USER or $UID would contain the value of the person's $USER & $UID that is accessing the mount.

Limiting access to the CIFS share

Regarding your question of how to limit access to a CIFS mount, I don't see a way to accomplish this with autofs.

The credentials used to mount a CIFS share are used throughout the duration that the share is mounted. In effect, autofs, running it's daemon automount as say root, is "equivalent" to the credentials of the CIFS user.

This isn't what I would consider typical behavior for autofs and is a by-product of using mount.cifs. Typical autofs behavior would respect the permissions on the other end of the mount, whereas with mount.cifs it does not.


I think you're out of luck accomplishing your setup using autofs. I think you're going to have to use fuse if you truly want each user to be accessing CIFS shares using their own credentials.

  • Thanks for this. Given autofs provides additional variables that are set based on the user requesting the mount, does that not mean $USER is already understood by autofs to be the guy who just cd'd into the path? Same with $HOME, I'd have thought. Is that the bit I am misunderstanding? Could it be more that the variable substitution cannot take place in the path part of the config file, only in the response part? So I can automount with config: /mydomain /etc/auto.mydomain --timeout=60 but I can't with config: $HOME/mydomain /etc/auto.mydomain --timeout=60? Jan 8, 2013 at 12:58
  • One other approach you can take is that the map files can be scripts, so you can have a program/script generate the output as long as it conforms to the key & value syntax. Here's an example: ubuntuforums.org/showthread.php?t=2036409
    – slm
    Jan 8, 2013 at 14:37
  • Yes my understanding is that those variables can only be used on the right side (the value) of the auto map files. The left side being the key. I've added additional notes to my answer to try and clear up what I was saying regarding the variables.
    – slm
    Jan 8, 2013 at 14:44
  • This is a matter of clarity in documentation then, I guess: the man line The following special variables will be substituted in the *key and location fields* of an automounter map if prefixed does not apply to the per-user variables that follow the man line autofs provides additional variables that are set based on the user requesting the mount. The script approach might be interesting, though. I'll see if I can wrap my head around coercing the logic into a working script... Jan 9, 2013 at 16:35
  • 1
    I believe it's background only. The script can merely dynamically generate the key,values that would normally be returned similar to a text file that contains the automount maps. I don't believe the users are able to interact with it in any way.
    – slm
    Jan 9, 2013 at 22:11

You can force the permissions set on the CIFS mount with the file_mode and dir_mode options, in conjunction with the uid=${USER} setting you were already using, giving an automount map line of something like this:

* -fstype=cifs,uid=${UID},gid=${EUID},file_mode=0600,dir_mode=0700,credentials=${HOME}/.smb/mydomain ://${SERVER}/&

The mounted filesystem will then be owned by the user, and the permissions set to disallow access to all other users. I've just tried this and it appears to work fine :)

You may want to set file_mode=0700 if there are executables you expect to be able to run stored on the share. My example removes the execute permission as that was the behaviour I wanted.

Note: This option may not have existed at the time the question was asked, but it does now!


Using Samba:

In /etc/auto.home:

*       -fstype=cifs,credentials=/etc/smbcreds.& ://MYSERVERIP/homes

You will need is to store all users and passwords in an independent file /etc/smbcreds

The last part of the line will mount via samba.

Using NFS:

In /etc/auto.home: (for NFS)

*       MYSERVERIP:/home/&

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .