On Wed, 29 May 2013 17:52:25 +0200
steve <steve@xxxxxxxxxxxx> wrote:
> On Tue, 2013-05-28 at 09:01 -0400, Jeff Layton wrote:
> > > How does this sound?
> > > - I make a domain user called cifsuser with rfc2307 uidNumber and
> > > gidNumber:
> > > uid=3000025(cifsuser) gid=20513(Domain Users) groups=20513(Domain Users)
> > >
> > > - I mount like this:
> > > sudo kinit cifsuser
> > > mount -t cifs //oliva/users /mnt -osec=krb5
> > > (just tried it: fine)
> > >
> > > -I stick cifsuser in the keytab and kinit -k it in a cron every few
> > > hours or so to keep it alive.
> > >
> > > Thanks so much for your time,
> > > Steve
> > >
> >
> > That sounds reasonable. Assuming that you don't actually do anything on
> > the mount as root, then you can give "cifsuser" very limited privileges
> > here too, essentially acting as a "squashed" user like under NFS.
> >
> > Also, there's no need to do this crontab stuff either. If you mount
> > with "-o sec=krb5,username=cifsuser" then cifs.upcall will be able to
> > just use /etc/krb5.keytab without you needing to do anything special.
> >
>
>
> Hi
> OK. Nearly done. I now have the automounter working:
> /etc/auto.users
> * -fstype=cifs,rw,sec=krb5,username=cifsuser,multiuser ://oliva/users/&
>
> It works fine except I have 2 keytabs per client.
> /etc/krb5.keytab
> produced by
> net ads join
> It contains the host/client and MACHINE$ keys
> and
> /etc/cifs.keytab
> produced the DC and copied to the clients which contains the cifsuser
> keys.
>
> Question: will cifs only look in /etc/krb5.keytab? Can I get it to look
> at /etc/cifs.keytab instead? OK, I can ktutil merge them but. . .
>
> Thanks for your patience.
>
>
Yes, it currently only looks at /etc/krb5.keytab. It probably wouldn't
be very hard to add a new command-line option to give it an alternate
one if that helps.
I do have a question here though. Why are you bothering with the
automounter at all? Why not instead just mount //oliva/users via fstab
at the point where auto.users is currently mounted?
That should give you the same effect with a much smaller mount table
and no automounter overhead. Something like this in /etc/fstab ought to
do it:
//oliva/users /path/to/top/of/users/dir cifs sec=krb5,username=cifsuser,multiuser 0 0
--
Jeff Layton <jlayton@xxxxxxxxx>
--
To unsubscribe from this list: send the line "unsubscribe linux-cifs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
