pam_mount não funciona ao efetuar login a partir do ssh ou do console

Question

ok então configurei o pam_mount na minha máquina centos 6 como fiz nas máquinas centos 7 e 5.

Mas quando eu faço login localmente ou via ssh, o pam_mount não pode montar meu diretório pessoal. quando eu faço o login com um usuário local, e su para um usuário que precisa do pam_mount montado no hmoe dir funciona bem e monta o diretório home.

o erro que recebo, quando o ssh ou o login do console é encontrado em /var/log/messages :

Feb 13 14:27:52 centosy sshd[1224]: pam_mount(mount.c:64): Errors from underlying mount program:
Feb 13 14:27:52 centosy sshd[1224]: pam_mount(mount.c:68): mount error(13): Permission denied
Feb 13 14:27:52 centosy sshd[1224]: pam_mount(mount.c:68): Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)
Feb 13 14:27:52 centosy sshd[1224]: pam_mount(pam_mount.c:521): mount of tomas failed
Feb 13 14:27:52 centosy sshd[1224]: pam_mount(pam_mount.c:172): conv->conv(...): Conversation error
Feb 13 14:27:52 centosy sshd[1224]: pam_mount(pam_mount.c:476): warning: could not obtain password interactively either
Feb 13 14:28:00 centosy sshd[1224]: pam_mount(mount.c:64): umount messages:
Feb 13 14:28:00 centosy sshd[1224]: pam_mount(mount.c:68): umount: /home/tomas: not mounted
Feb 13 14:28:00 centosy sshd[1224]: pam_mount(mount.c:722): unmount of tomas failed
Feb 13 14:33:59 centosy kernel: Status code returned 0xc000006d NT_STATUS_LOGON_FAILURE
Feb 13 14:33:59 centosy kernel: CIFS VFS: Send error in SessSetup = -13
Feb 13 14:33:59 centosy kernel: CIFS VFS: cifs_mount failed w/return code = -13

my pam.d / system-auth:

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_ldap.so use_first_pass
auth        required      pam_deny.so
auth        optional      pam_mount.so

account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    sufficient    pam_ldap.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_ldap.so
session     optional      pam_mount.so
session     required      pam_mkhomedir.so skel=/etc/skel/ umask=0022

meu pam.d/password-auth :

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_ldap.so use_first_pass
auth        required      pam_deny.so
auth        optional      pam_mount.so

account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    sufficient    pam_ldap.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_ldap.so
session     optional      pam_mount.so
session     required      pam_mkhomedir.so skel=/etc/skel/ umask=0022

meu pam_mount.conf.xml:

?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">
<!--
        See pam_mount.conf(5) for a description.
-->

<pam_mount>

            <!-- debug should come before everything else,
                since this file is still processed in a single pass
                from top-to-bottom -->

<debug enable="0" />

                <!-- Volume definitions -->
<volume user="*" fstype="cifs" server="zentyal" path="%(DOMAIN_USER)" mountpoint="/home/%(DOMAIN_USER)" options="sec=ntlmsspi,nodev,nosuid" />

                <!-- pam_mount parameters: General tunables -->

<!--
<luserconf name=".pam_mount.conf.xml" />
-->

<!-- Note that commenting out mntoptions will give you the defaults.
     You will need to explicitly initialize it with the empty string
     to reset the defaults to nothing. -->
<mntoptions allow="nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other" />
<!--
<mntoptions deny="suid,dev" />
<mntoptions allow="*" />
<mntoptions deny="*" />
-->
<mntoptions require="nosuid,nodev" />

<logout wait="0" hup="0" term="0" kill="0" />


                <!-- pam_mount parameters: Volume-related -->

<mkmountpoint enable="1" remove="true" />


</pam_mount>

alguém pode ver o erro e sabe como consertar isso?

    

Answer 1

Você pode acompanhar minhas instruções. Isso funciona para mim no Centos 7.0 & 7.1 e não foi testado no Centos 6.X.

Etapa 1 : instale o pam_mount e o cifs-utils .

Step 2: Por favor, apenas configure o arquivo /etc/pam.d/password-auth , apenas adicione 2 linhas (uma é ativada topo, e o outro está no final do arquivo)

auth        required      pam_mount.so
auth        required      pam_env.so

# ... file's other contents ...

session     optional      pam_winbind.so
session     optional      pam_mount.so

Etapa 3 : configure /etc/security/pam_mount.conf.xml

    <!-- pam_mount parameters: Volume-related -->
    <mkmountpoint enable="1" remove="true" />

    <volume user="*" fstype="cifs" server="fileserver" path="shared name of directory" mountpoint="/mnt/" options="sec=ntlm,nodev,nosuid" />
</pam_mount>

Lembre-se: Desative o SElinux.