Automount SMB share

[CyberNerd]

Teachers want to run an old dos application, but I'm having problems with it. Decided to try running it on dosbox and it appears fine - so the plan is to allow students to log in to linux server and run the app. Students already use server for a php/mysql course but use local directories autocreated with pam_mkhomedir.so. Winbind/Samba etc is working.

Now I need to mount the \\server\username share on mount as a subdirectory of the /home/DOMAIN/user , I've looked at pam_mount and it supports smb/cifs but anyone know a good howto for pam_mount or can post a config as a starting point? sevrer is Centos4.4 but anything will help. TIA

pam is a headache

[Ric_]

Was thinking about something similar earlier today... don't know why. I was thinking along the lines of writing a bash script to mount the folder to a directory... could this not be done?

[CyberNerd]

probably, but I can forsee permissions being a mess.

I think pam_mount is the way forward.

I found this:

http://wiki.ltsp.org/twiki/bin/view/Ltsp/WinIntegration

and will give it a try when my head recovers

[Ric_]

Just thinking out loud but surely if you use Samba, etc. the user permissions/authentication will be sorted out for you.

[CyberNerd]

.. I think to do that the user would need to re-enter the password in order to mount the share (using a script) but I can't see this working on logon easily without the pam_mount. I'm having problems with domain users smbmounting anything at the moment. I needed to do "chmod +s smbmnt" - but still I get permissions problems. Not tried with the pam_mount yet - does this overcome these problems by using root permissions instead of normal user to mount ? or do I need to get normal users mounting drives first? I'm not sure of the security implications here.

[Geoff]

pam_mount runs suid (as do the other pam modules), so yes there's no problem with permissions.

 

As a rule of thumb, running suid is bad. Any bugs in the suid software opens your box to being rooted.

[tom_newton]

Just out of being nosy - any reason why you cant run it in DOSBox under win32?

 

I run "Railroad Tycoon" under that environment, and its fine. Well, until my g/f tells me to stop playing "that stupid train game"

[Geoff]

Cybernerd has Linux based systems/thin clients IIRC...

[CyberNerd]

TBO, I didn't realised Dosbos ran on windows (goes and looks at website...)

I just tested it on my ubuntu workstation and it was fine. I'd like to get a *nix application server running in any case - it would be good for older educational apps that run fine in wine (but not on windows Citrix servers), for our php/mysql course and maybe we could even move cross-platform apps to FreeNX and save some windows licenses.

[Geoff]

Another thought occurred to me. Do you also have pam_krb5 installed as part of the login process. They wont be able to mount anything on the AD based servers unless they have a valid kerberos ticket.

[CyberNerd]

Cybernerd has Linux based systems/thin clients IIRC...

 

The majority our users see is Windows Desktop via Citrix - although the TC clients are linux.

[CyberNerd]

@ Geoff, thanks - I'll try and work through this documentation when I get a chance http://cb-net.co.uk/readarticle.php?article_id=5 It has a setup of all the different pam options.

[CyberNerd]

I've had some luck with this - not with Centos though, couldn't find a new enough package of pam_mount, dependancy hell - tried Ubuntu and it worked in ssh after some fscking around (not that dosbox will run in ssh but that's beside the point now). Still having problems with permissions after pam_mount has mounted the windows share - also it doesn't want to unmount it when the user logs off, but otherwise ok in testing. will post a howto for you lot to rip to shreds when I have time.

[ChrisH]

will post a howto for you lot to rip to shreds when I have time.

 

What are you trying to say

[CyberNerd]

partly from memory, partly from bash_history.

 

please improve this and I'll add to wiki:

 

Installing a Multi user Ubuntu system in a MS Active Directory environment with homedrives on windows share -non kerberos method.

 

Install Ubuntu server 6.06

Enable multiverse and Universe repositories by

 

 sudo vi /etc/apt/sources/ 

 

update sources, upgrade and install a text editor

 

 sudo apt-get update && sudo apt-get upgrade && sudo apt-get install joe

 

Install and configure ntpdate to keep the time in sync with Active Directory servers – this is only really necessary using kerberos, which this method does not, but it's nice to be time-synced.

edit : when I originally did this I did setup kerberos before it was joined to the domain.

sudo apt-get install ntpdate 

Edit the /etc/default/ntpdate file using the following command and add you Active Directory Time servers

 sudo jmacs /etc/default/ntpdate 

ntpdate will automatically run while booting the system. Ubuntu stores script at /etc/network/if-up.d/ntpdate location.

If you wish to just run script again just type command

 sudo /etc/network/if-up.d/ntpdate 

 

Install Samba, Winbind, libpam-mount etc

 sudo apt-get install winbind samba libpam-mount smbfs smbclient 

Configure Samba

 jmacs /etc/samba/smb.conf 

[global]
       workgroup = DOMAIN
       obey pam restrictions = yes
       security = ads
       realm = DOMAIN.EXAMPLE
       password server = AD-server-IP-goes-here
#       winbind separator = +
       idmap uid = 10000-20000
       idmap gid = 10000-20000
       winbind enum users = yes
       winbind enum groups = yes
       template homedir = /home/%D/%U
       template shell = /bin/bash
       client use spnego = yes
       client ntlmv2 auth = yes
       encrypt passwords = yes
       winbind use default domain = yes
       restrict anonymous = 2
# to avoid the workstation from
# trying to become a master browser
# on your windows network add the
# following lines
       domain master = no
       local master = no
       preferred master = no
       os level = 0

restart samba

/etc/init.d/winbind stop
/etc/init.d/samba restart
/etc/init.d/winbind start

 

join to domain

 sudo net ads join -U administrator 

check users and groups :

wbinfo -u
wbingo -g 

 

edit nsswitch:

sudo jmacs /etc/nsswitch.conf

# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd:         compat winbind
group:          compat winbind
shadow:         compat

hosts:          files dns mdns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis

 

test – should see all domain accounts:

 getent passwd

 

edit the following files:

jmacs /etc/pam.d/common-account
jmacs /etc/pam.d/common-auth
jmacs /etc/pam.d/common-session
jmacs /etc/security/pam_mount.conf

# /etc/pam.d/common-account - authorization settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authorization modules that define
# the central access policy for use on the system.  The default is to
# only deny service to users whose accounts are expired in /etc/shadow.
#
account sufficient      pam_winbind.so
account required        pam_unix.so

 

# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.).  The default is to use the
# traditional Unix authentication mechanisms.
#
#auth   required        pam_unix.so nullok_secure
auth    required        pam_mount.so

#next line will validate ONLY off of network
#auth   required        pam_winbind.so use_first_pass

## use the TWO "auth" lines below for either network or local validation -
## will validate off of EITHER network or local passwd db

auth    sufficient      pam_winbind.so use_first_pass

 

# /etc/pam.d/common-session - session-related modules common to all services
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define tasks to be performed
# at the start and end of sessions of *any* kind (both interactive and
# non-interactive).  The default is pam_unix.

session required        pam_unix.so

session required        pam_mkhomedir.so umask=0022 skel=/etc/skel/
session optional        pam_mount.so

 

 

 

 

create the default directory

 sudo mkdir /home/DOMAIN 

maybe change perms on this?

 

 

This bit does the Automount \\server\student$ homedrives on login:

from /etc/security/pam_mount.conf

comment out:

options_require nosuid,nodev

 

add

volume * cifs FileServerName &$ /home/DOMAIN/& username=&,uid=&,dmask=0750,workgroup=DOMAIN - -

 

login.

 

install desktop

 

 sudo apt-get install xubunu-desktop 

 

install and configure FreeNX........

 

 

refs:

http://tech.canterburyschool.org/tech/UbuntuWorkstations

[Geoff]

Some comments:

 

apt-get install joe

Ubuntu installs nano by default.

 

Install and configure ntpdate to keep the time in sync with Active Directory servers

 

Like I said in previous threads, I prefer to use ntpd. ntpdate only runs at machine startup. If the machine is on for any length of time with a wobbly hardware clock it'll slowly drift out of the 5 minute window and kerberos will break.

 

this is only really necessary using kerberos, which this method does not, but it's nice to be time-synced.

 

Kerberos is required for the correction functioning of winbind and samba in a AD enviroment (security = ADS in smb.conf).

 

apt-get install krb5-user
rm /etc/krb.conf

 

password server = AD-server-IP-goes-here

 

You can leave this out and Samba will go and find the nearest DC based on DNS.

 

hosts:          files dns mdns

If you add 'wins' here you can also allow the machine to do netbios name resolution. Although you shouldn't need to do this in an AD enviroment (because everything should be registered in DNS) sometimes the odd legacy client that you have to talk to isn't (found this out talking to print servers!).

 

options_require nosuid,nodev

Also consider noexec, this'll stop the little blighters running Linux executables from their home folders.

[CyberNerd]

this is only really necessary using kerberos, which this method does not, but it's nice to be time-synced.

 

Kerberos is required for the correction functioning of winbind and samba in a AD enviroment (security = ADS in smb.conf).

 

Interesting, this has been my biggest headache, what the krb5 is doing- my krb5.conf works fine but since I had no krb5 in the pam config I thought I'd test - I removed /etc/krb5.conf and nothing seemed to change - homedirectories are mounted and users login without a functioning kerberos. Do you happen to know which parts of samba ads mode require this? or should I just enable for good measure? I get the impession kerberos/LDAP are indepandant from winbindd

[Geoff]

If you have no kerberos installed, you cannot get a kerberos ticket. If you have no kerberos ticket authentication fails (Winbind fails at this point). If authentication fails you cannot do LDAP lookups (Samba fails here).

[danboid]

Hi!

 

I've tried just about every guide on the net on how to get automounting of folders after a GDM login to work but I've had no luck yet and CyberNerds guide is no exception although I realise he wrote it for 'buntu 6.06 and I'm trying to get it to work under 9.04 which will have much more recent versions of samba etc. of course, no doubt with all-new config file formats and options etc.

 

I didn't follow the guide to the letter as I joined to the domain with openlikewise first (which works fine) and I also ignored his ntp instructions in favour of setting up openntpd as was recommended in the comments that followed the guide. All went went until I got up to:

 

root@ohgs-desktop:/etc/samba# wbinfo -u

Error looking up domain users

root@ohgs-desktop:/etc/samba# wbinfo -g

Error looking up domain groups

 

So at that point I gave up as I presumed samba wasn't setup properly despite the fact that the net command supposedly did join me to the domain correctly but maybe this is conflicting with openlikewise??

 

So, does anyone know of a complete, up-to-date AND easy to follow guide to adding a 9.04/GDM box to a w2k3 AD domain and have it so that users network home folders get automounted? Also, is there any reason I can't or shouldn't auto mount the network drives to /home/$username instead of /home/$domain/$username as most guides seem to do?

 

Thanks!

[CyberNerd]

A blast from the past...

This is how we setup our samba fileservers, on RHEL5. should be similar for ubuntu:

 

http://www.edugeek.net/wiki/index.php/Samba_Homedirectory

[danboid]

I gave up on trying to set this up manually under Jaunty and I'm now working on getting this going using suse's Windows Domain Membership config tool (under Yast)- opensuse seems to be the only distro attempting to make this process relatively easy but its still far from click n' connect, there are a number of tweaks to perform before you can run the domain membership tool.

 

I've now got Yast to configure suse as far as using openlikewise took me under 'buntu in that I can now log in using an AD members credentials and I know that I'm very close to having Yast set up automounting of the users home folders but its just not quite working yet. I can feel quite confident in saying that (unbelievably) no-one seems to have wrote an idiots guide to setting this whole thing up using yast and I believe this is why Linux isn't seeing more use in our schools and in other organisations as this functionality is a basic requirement for acceptance/ integration into the majority of our still mostly Windows dominated networks.

 

Once we have this process nailed I'm going to write an idiots guide to doing this that anyone with basic Linux skills and enough knowledge to add a windows machine to an AD domain will be able to easily follow that can go on the opensuse and edugeek wikis. Sound good to you? Here's a summary of my current status which I posted to the opensuse forums yesterday but which I've had no response to yet:

 

----------------------------------

 

I'm testing out opensuse's (11.1 i686 GNOME) AD integration features as I'd like to have Linux used in our school outside of the server room but I need a fully-working prototype before that can happen. After a significant bit of wrestling with Yast and various config files I now have AD login/ authentication working but I've been unable to get AD users home folders to auto-mount correctly.

 

Under Yast/ Windows Domain Membership/ Expert settings I have left the UID/GID and WINS options at their default values as I don't think they're relevant to what I'm trying to do but I added an entry to the 'Mount Server Directories' list with these values:

 

----------------

 

Server Name: server (I'm presuming I could put any name in here or must it match the DC's DNS/ realm name?)

 

Remote Path: //192.168.0.3/student/%(DOMAIN_USER)

 

Mount Point: /home/SERVER/%(DOMAIN_USER)

 

Options: user=%(DOMAIN_USER) (The default)

 

User Name: (Left Blank as I want home folder mounted for all users that log in, right?)

 

----------------

 

I have noticed that even if I uncheck 'Create Home Directory on Login' a home folder gets created under /home/SERVER/%username anyway and so thats why I have used '/home/SERVER/%(DOMAIN_USER)' for the mount point even though I'd rather just use /home/%username as the local mount point. Can I do that instead?

 

If I log in as an AD domain user then I open nautilus and go to 'smb://192.168.0.3/student/' I can see all the home folders and I know pam is mostly working as I can access files with my users home folder but not other users but this folder isn't being auto-mounted under /home/SERVER/%(DOMAIN_USER). Any ideas?

 

Finally, after having added the suse box to the domain I get an extra drop-down on the gdm login screen that lets me choose if I want to log in locally or to the AD domain. However, it doesn't matter whether I choose local login or domain login from this menu as I still have to login like 'server\user' for the username. I would like it if users had no need to prefix their user name with the domain name when logging in at all or at least no need to do so when they choose the domain from the menu. Can this be done?

 

Thanks!