pam_mkhomedir umask

[ozydave]

Hello,

 

I have got my Ubuntu 18.10 joined to my domain using realmd.

I can login using an AD account and a home drive get created under /home/Aduser. So far so good.

But.

 

The users home directory gets created with 755 (drwxr-xr-x)

I have added to /etc/pam.d/common-session and / or /etc/pam.d/sshd

session required pam_mkhomedir.so skel=/etc/skel/ umask=0022

But it makes no difference.

(I have restarted after every change)

 

I’m far from a Linux guru but would like to get this working.

Any pointers would be great, I have googled for a couple of days so thought I would now try the experts!!

 

Cheers

[PyROm]

Are you using SSSD or winbind as your auth service on linux? (I believe realmd configures one of them depending on which you choose). If it is winbind then you will need to edit the samba config file (winbind is part of samba), normally at /etc/samba/smb.conf Edited April 5, 2019 by PyROm

[ozydave]

It's sass being used.

 

I can change

skel=/etc/skel/ umask=0022

 

To skel=/etc/skeltest/ umask=0022

If I add some random thing to skeltest then login the user will pick up the new skel.

 

So I know the line is being read at login but the umask seems to ignored

[powdarrmonkey]

I have added to /etc/pam.d/common-session and / or /etc/pam.d/sshd

session required pam_mkhomedir.so skel=/etc/skel/ umask=0022

But it makes no difference.

(I have restarted after every change)

 

I’m far from a Linux guru but would like to get this working.

 

You've described what you've done and that it doesn't do what you expect, but you haven't said what you're trying to achieve. What mode are you trying to get on that directory?

[ozydave]

Good point!

When an AD users logs in the home folders are created.

The next AD user that logs in can open and read the first users folders and files.

 

I want to stop each AD user being able to browse/open other users files /folders

[powdarrmonkey]

Well that's easy then; the mask to achieve that is 0077, not 0022.

 

The reason you don't think it's working is that you're not actually changing the mask in your tests. From pam_mkhomedir(8):

 

umask=mask

The user file-creation mask is set to mask. The default value of mask is 0022.

[ozydave]

Well that's easy then; the mask to achieve that is 0077, not 0022.

 

The reason you don't think it's working is that you're not actually changing the mask in your tests. From pam_mkhomedir(8):

Ah not so easy! I have set the umask value to all sorts. 0077, 0777, 0644, 0666 etc etc.

Changing the umask value makes no difference to the folder permissions

[powdarrmonkey]

It works fine for me enabling pam_mkhomedir via pam-auth-update(8) and then adding

umask=0077

to the generated line in /etc/pam.d/common-session. Rule out your authentication thing doing weird magic by testing with a plain 'su' operation, check you don't have extended ACLs on the parent directory, and check you don't have another line in /etc/pam.d anywhere.

Edited April 7, 2019 by powdarrmonkey

[ozydave]

All sorted now. I reinstalled Ubuntu, followed the same instructions to join it to the domain. This time it works

 

All i can guess is that somewhere i had put a funky line of code in.

so cheers for the help.

 

One last question (for the moment)

 

when any user logins in they are presented with the 'Welcome to Ubuntu' screen.

Is there any way to turn it off for all users?

 

Cheers