Re: cifs-utils VFS errors

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Wed, 29 May 2013 17:52:25 +0200
steve <steve@xxxxxxxxxxxx> wrote:

> On Tue, 2013-05-28 at 09:01 -0400, Jeff Layton wrote:
> > >  How does this sound?
> > > - I make a domain user called cifsuser with rfc2307 uidNumber and
> > > gidNumber:
> > > uid=3000025(cifsuser) gid=20513(Domain Users) groups=20513(Domain Users)
> > > 
> > > - I mount like this:
> > > sudo kinit cifsuser
> > > mount -t cifs //oliva/users /mnt -osec=krb5
> > > (just tried it: fine)
> > > 
> > > -I stick cifsuser in the keytab and kinit -k it in a cron every few
> > > hours or so to keep it alive.
> > > 
> > > Thanks so much for your time,
> > > Steve
> > > 
> > 
> > That sounds reasonable. Assuming that you don't actually do anything on
> > the mount as root, then you can give "cifsuser" very limited privileges
> > here too, essentially acting as a "squashed" user like under NFS.
> > 
> > Also, there's no need to do this crontab stuff either. If you mount
> > with "-o sec=krb5,username=cifsuser" then cifs.upcall will be able to
> > just use /etc/krb5.keytab without you needing to do anything special.
> > 
> 
> 
> Hi
> OK. Nearly done. I now have the automounter working:
> /etc/auto.users
> * -fstype=cifs,rw,sec=krb5,username=cifsuser,multiuser ://oliva/users/&
> 
> It works fine except I have 2 keytabs per client.
>  /etc/krb5.keytab
> produced by
>  net ads join
> It contains the host/client and MACHINE$ keys 
> and 
>  /etc/cifs.keytab
> produced the DC and copied to the clients which contains the cifsuser
> keys.
> 
> Question: will cifs only look in /etc/krb5.keytab? Can I get it to look
> at /etc/cifs.keytab instead? OK, I can ktutil merge them but. . .
> 
> Thanks for your patience.
> 
> 

Yes, it currently only looks at /etc/krb5.keytab. It probably wouldn't
be very hard to add a new command-line option to give it an alternate
one if that helps.

I do have a question here though. Why are you bothering with the
automounter at all? Why not instead just mount //oliva/users via fstab
at the point where auto.users is currently mounted?

That should give you the same effect with a much smaller mount table
and no automounter overhead. Something like this in /etc/fstab ought to
do it:

    //oliva/users  /path/to/top/of/users/dir   cifs  sec=krb5,username=cifsuser,multiuser 0 0

-- 
Jeff Layton <jlayton@xxxxxxxxx>
--
To unsubscribe from this list: send the line "unsubscribe linux-cifs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux