Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've configured pam_mount.so to automagically mount a cifs share when users login; the problem is if a user logs into multiple times simultaneously, the mount command is repeated multiple times.

This so far isn't a problem but it's messy when you look at the output of a mount command.

# mount
/dev/sda1 on / type ext4 (rw,errors=remount-ro)
proc on /proc type proc (rw,noexec,nosuid,nodev)
none on /sys type sysfs (rw,noexec,nosuid,nodev)
none on /sys/fs/fuse/connections type fusectl (rw)
none on /sys/kernel/debug type debugfs (rw)
none on /sys/kernel/security type securityfs (rw)
none on /dev type devtmpfs (rw,mode=0755)
none on /dev/pts type devpts (rw,noexec,nosuid,gid=5,mode=0620)
none on /dev/shm type tmpfs (rw,nosuid,nodev)
none on /var/run type tmpfs (rw,nosuid,mode=0755)
none on /var/lock type tmpfs (rw,noexec,nosuid,nodev)
none on /lib/init/rw type tmpfs (rw,nosuid,mode=0755)
//srv1/UserShares/jrisk on /home/jrisk type cifs (rw,mand)
//srv1/UserShares/jrisk on /home/jrisk type cifs (rw,mand)
//srv1/UserShares/jrisk on /home/jrisk type cifs (rw,mand)

I'm assuming I need to fiddle with either the pam.d/common-auth file or pam_mount.conf.xml to accomplish this.

How can I instruct pam_mount.so to avoid duplicate mountings?


[Edit]

The contents of my pam_mount.conf.xml file:

<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">
<pam_mount>
  <debug enable="1" />
  <volume user="*" server="srv1" path="UserShares" mountpoint="home" fstype="cifs" />
  <cifsmount>mount -t cifs //%(SERVER)/%(VOLUME)/%(USER) %(MNTPT)/%(USER) -o "user=%(USER),uid=%(USERUID),gid=%(USERGID)%(before=\",\" OPTIONS)"</cifsmount>
  <umount>umount %(MNTPT)/%(USER)</umount>
  <mntoptions allow="nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other" />
  <mntoptions require="nosuid,nodev" />
  <path>/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin</path>
  <logout wait="0" hup="0" term="0" kill="0" />
  <mkmountpoint enable="1" remove="true" />
</pam_mount>
share|improve this question
    
Hrm, it is only supposed to mount a share once, and then do reference counting to figure out which to unmount. You might need to post the the relevant portion of your pam_mount.conf.xml. –  Zoredache Apr 23 '10 at 19:41
    
@Zoredache: Its a relief to be told that the default behaviour is what I want, on Monday I'll upload the relevant files and hopefully get this issue addressed. Thanks. –  Jamie Apr 24 '10 at 13:05
add comment

5 Answers

"Multiple simultaneous logins" is probably the key. More than likely, what's happening is that the second and subsequent mount commands are getting launched prior to the first mount command finishing. This seems very likely, given how slow network mount commands run. What you probably need is some sort of shared memory / state file / etc which can make sure that only one mount process will start up. Well, at least until the pam_mount author works in a long-term fix for that race condition... :)

You might look at the pam_tally module. You could use that module to maintain a login counter per-user, and deny if the count is over 1. In the control field, then, you could set it up so that the pam_mount module is skipped if pam_tally fails. Specifically, I think maybe something like this would work:

auth [success=ignore default=1] pam_tally.so deny=1 onerr=succeed no_lock_time no_reset
auth optional pam_mount.so pam_mount_options

...Or something along those lines. The am_tally2 module would also work, if you need some external system to also manipulate the counter, say, when you manually unmount a filesystem or something (since pam_tally2 comes with a binary that can be used to manipulate the counts).

share|improve this answer
    
Or you could just symlink /etc/mtab to /proc/mounts, since /proc/mounts won't have dups. ;) –  dannysauer Apr 24 '10 at 16:16
    
I tried pam_tally.so: most likely a syntax thing but I couldn't get to work. –  Jamie May 7 '10 at 1:49
add comment

The offending line was in my pam_mount.conf.xml file:

<mkmountpoint enable="1" remove="true" />

should be:

<mkmountpoint enable="1" remove="false" />

With the value set to true, the pam_mount.so module was trying to remove /home/$USER/ from the system, not, as I assumed, ./$USER in the /home/ directory.

share|improve this answer
1  
I was mistaken, this didn't to correct the problem above. –  Jamie May 7 '10 at 1:47
add comment

I suspect that pam_mount is failing to unmount the directory. Could you please confirm if the directory remains mounted after the user logged out with a mount?

If that's the case, the only solution I know of is using pam_script to run a umount -l /home/$USER on session close.

share|improve this answer
    
Thanks for the suggestion. I find again that I'm impressed with all the optional libraries PAM supports. This library strikes me as a little inelegant and circumventing the issue rather than addressing it. –  Jamie May 11 '10 at 13:59
    
I agree. I ended up using pam_script handling both mount and umount in a custom script done by me. –  jneves May 11 '10 at 19:59
add comment

Why not use autofs?

share|improve this answer
add comment

Make sure you put a trailing slash for "path" (eg path="userShares/")like so:

<volume user="*" server="srv1" path="UserShares/" mountpoint="home" fstype="cifs" />

The problem is that a trailing slash is added to the entry in /etc/mtab. So when pam_mount is called again, it cannot see an exact match, so will mount the share again, hence you have multiple mounts.

See this bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=586009

share|improve this answer
2  
That doesn't seem to be the case. A dump of /etc/mtab doesn't show the trailing /, but I tried your suggestion just the same with no affect. –  Jamie Feb 26 '12 at 0:25
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.