cifs/smbfs Machine Account

[apeo]

Is it possible to use machine account to authenticate against using cifs/smbfs? I mean in smbclient you can use -P to tell it to use the machine account of the local computer, rather then using a user and password.

[Geoff]

Can explain exactly what you are trying to do? Which machine account? The local one? Authenticate to do what? Connect to a share? A printer? Interactive Login?

[apeo]

Sorry, Im mounting a windows share from a nix server and using the machine account in AD i.e. the computer object that is registered for the nix server in AD. The smbclient would be:

 

sudo smbclient //windowsserver/share -P

 

Just wondering if its possible to cifs/smbfs mount using these credentials instead of providing a username and password, and if it would work in fstab.

[Geoff]

assuming the *nix machine is correctly joned to the domain then yes.

[apeo]

so what would the cifs/smbfs command/options be?

 

If it was in fstab it would be something like:

 

//servername/sharename /media/windowsshare cifs username=username,password=password,iocharset=utf8,file_mode=0777,dir_mode=0777 0 0

 

but what would i put in instead of username and password?

[Geoff]

You can't do that within the fstab.

[somabc]

You should use PAM_MOUNT to mount the folder

[Geoff]

heck you could even use fuse

[apeo]

Ah ok, I'll have a read about FUSE and PAM_MOUNT

[apeo]

Well after doing some reading and I cant figure out how to use either FUSE or PAM_MOUNT in fstab i.e. mount on boot. Didnt even get to the point where i had an entry into fstab let alone trying to see it it would use machine account credentials (i.e. the computer object that is registered in AD). Can someone send me in the right direction so I can look it up?

[CyberNerd]

Well after doing some reading and I cant figure out how to use either FUSE or PAM_MOUNT in fstab i.e. mount on boot. Didnt even get to the point where i had an entry into fstab let alone trying to see it it would use machine account credentials (i.e. the computer object that is registered in AD). Can someone send me in the right direction so I can look it up?

 

I can help with pam_mount. It works on login, rather than in fstab, so not sure it's what you need really.

install samba-client and pam_mount etc

 

and set this in /etc/pam.d/password-auth

 

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
[b]auth	    required	  pam_mount.so [/b]
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_krb5.so use_first_pass
auth        sufficient    pam_winbind.so cached_login use_first_pass
auth        required      pam_deny.so

account     required      pam_access.so
account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_krb5.so
account     [default=bad success=ok user_unknown=ignore] pam_winbind.so cached_login
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    sufficient    pam_krb5.so use_authtok
password    sufficient    pam_winbind.so cached_login use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     optional      pam_mkhomedir.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
[b]session optional pam_mount.so [/b]
session     optional	  pam_krb5.so

 

and this in /etc/security/pam_mount.conf

 

[apeo]

Thanks for that, I was really looking at mounting on boot rather then login. Appreciate the info though as its useful for the future.

 

It seems that you cant use the machine account to mount windows share on boot, just annoying that its possible with smbclient.

[dhicks]

Just wondering if its possible to cifs/smbfs mount using these credentials instead of providing a username and password, and if it would work in fstab.

 

If you can't use fstab, can you put the appropriate command in /etc/rc.local to be run on boot?

[CyberNerd]

If you can't use fstab, can you put the appropriate command in /etc/rc.local to be run on boot?

 

That would work, you could also have a cron script to check if it is still mounted and remount if the server goes down.

 

In preference I usually mount using NFS, I appreciate its more difficult on a windows server, we don't have any windows fileservers as linux has superseded them all.

[Geoff]

If you install services for unix on the windows server you can expose the windows shares over NFS.

 

http://technet.microsoft.com/en-us/library/cc753302(v=ws.10).aspx

[User3204]

I use this Automatic backup to a Windows share |*CensorNet which allows me to connect to a SAMBA share on boot.

 

Basically:

//adserver/Public /mnt/win smbfs defaults,user,auto,username=joe,password=password123 0 0

in the fstab file.

 

The trouble is, you're not supposed to use smbfs and smbclient anymore, dunno why, but Ubuntu tells me off.

[apeo]

@Geoff: Interesting.. messed around, created a Windows Server 2008 R2 NFS server and it looks like I can create an NFS share to allow only a specified host to connect. Then granting Everyone access in ntfs acl to grant access to unmapped unix users because I dont want to configure user mapping. Still not really using machine account as a means to authenticate but its close as im going to get to it i guess...?

[Geoff]

Yeah that'll do. Just watch out for issues with the permission and user/group ownership translation when writing files back to the NFS share.

[apeo]

Right, I'll do a few tests and see how the permissions translate. BTW what are the security implications if i enable root access? It says Not Recommended in brackets. I know that when unmapped users access the nfs share it maps to Anonymous but if you enable root access, it maps root to Administrator. Can I assume that its only the nfs share that root has access to and nothing else i.e. there's no way for root to access any other part of of the computer or even the network as Administrator? Can I also assume that if the nfs share is on a DC then root will map to AD Administrator? so what are the issues with this?

[Geoff]

The default for NFS (at least on Linux) is for root to be mapped to guest. That way nothing bad happens when you mount an NFS share from a server you do not entirely trust or do not know where all its files came from. If you don't care about security then yes, allow root access.

[apeo]

The default for NFS (at least on Linux) is for root to be mapped to guest. That way nothing bad happens when you mount an NFS share from a server you do not entirely trust or do not know where all its files came from. If you don't care about security then yes, allow root access.

 

It seems that with Windows NFS, root gets mapped to Administrator and if you dont allow root access, then it does exactly that (stop root access). Sorry for all the questions, can I just clarify what would be the Security issue with enabling root? I assume its something to do with the fact that it gets mapped to Administrator but if it only has access to the nfs share only then I dont see how thats different from granting Everyone full permissions to the folder.

[Geoff]

Assume Bob and John both use the same NFS server for a shared project. Assume their client machines both mount the same NFS share with root access intacted. Now assume there is some script or program contained within this NFS share that needs root access to do its job. Bob alters this script/program and introduces an error that causes it to corrupt filesystem data. Bob doesn't test this change but John does. Bob just hosed Johns machine via NFS. The system administrator investigates and also runs the program without the protection of a chroot jail. Bob just broke the server too.