1

okay so i configured pam_mount on my centos 6 machine as i did on my centos 7 and 5 machines.

But when i login locally or via ssh, pam_mount can't mount my home dir. when i login with a local user, and su to a user who needs the hmoe dir mounted pam_mount works fine and mount the home dir.

the error i get, when i ssh or log in from console is found in /var/log/messages:

Feb 13 14:27:52 centosy sshd[1224]: pam_mount(mount.c:64): Errors from underlying mount program:
Feb 13 14:27:52 centosy sshd[1224]: pam_mount(mount.c:68): mount error(13): Permission denied
Feb 13 14:27:52 centosy sshd[1224]: pam_mount(mount.c:68): Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)
Feb 13 14:27:52 centosy sshd[1224]: pam_mount(pam_mount.c:521): mount of tomas failed
Feb 13 14:27:52 centosy sshd[1224]: pam_mount(pam_mount.c:172): conv->conv(...): Conversation error
Feb 13 14:27:52 centosy sshd[1224]: pam_mount(pam_mount.c:476): warning: could not obtain password interactively either
Feb 13 14:28:00 centosy sshd[1224]: pam_mount(mount.c:64): umount messages:
Feb 13 14:28:00 centosy sshd[1224]: pam_mount(mount.c:68): umount: /home/tomas: not mounted
Feb 13 14:28:00 centosy sshd[1224]: pam_mount(mount.c:722): unmount of tomas failed
Feb 13 14:33:59 centosy kernel: Status code returned 0xc000006d NT_STATUS_LOGON_FAILURE
Feb 13 14:33:59 centosy kernel: CIFS VFS: Send error in SessSetup = -13
Feb 13 14:33:59 centosy kernel: CIFS VFS: cifs_mount failed w/return code = -13

my pam.d/system-auth:

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_ldap.so use_first_pass
auth        required      pam_deny.so
auth        optional      pam_mount.so

account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    sufficient    pam_ldap.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_ldap.so
session     optional      pam_mount.so
session     required      pam_mkhomedir.so skel=/etc/skel/ umask=0022

my pam.d/password-auth:

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_ldap.so use_first_pass
auth        required      pam_deny.so
auth        optional      pam_mount.so

account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    sufficient    pam_ldap.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_ldap.so
session     optional      pam_mount.so
session     required      pam_mkhomedir.so skel=/etc/skel/ umask=0022

my pam_mount.conf.xml:

?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">
<!--
        See pam_mount.conf(5) for a description.
-->

<pam_mount>

            <!-- debug should come before everything else,
                since this file is still processed in a single pass
                from top-to-bottom -->

<debug enable="0" />

                <!-- Volume definitions -->
<volume user="*" fstype="cifs" server="zentyal" path="%(DOMAIN_USER)" mountpoint="/home/%(DOMAIN_USER)" options="sec=ntlmsspi,nodev,nosuid" />

                <!-- pam_mount parameters: General tunables -->

<!--
<luserconf name=".pam_mount.conf.xml" />
-->

<!-- Note that commenting out mntoptions will give you the defaults.
     You will need to explicitly initialize it with the empty string
     to reset the defaults to nothing. -->
<mntoptions allow="nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other" />
<!--
<mntoptions deny="suid,dev" />
<mntoptions allow="*" />
<mntoptions deny="*" />
-->
<mntoptions require="nosuid,nodev" />

<logout wait="0" hup="0" term="0" kill="0" />


                <!-- pam_mount parameters: Volume-related -->

<mkmountpoint enable="1" remove="true" />


</pam_mount>

can anyone see the error, and knows how to fix this?

  • SELinux enabled? – Federico Sierra Feb 13 '15 at 15:27
  • @FedericoSierra SElinux is disabled – Tomas Feb 18 '15 at 12:05
0

You can follow up my instruction. This works for me on Centos 7.0 & 7.1 and has not been tested on Centos 6.X.

Step 1: Install pam_mount and cifs-utils.

Step 2: Please only configure file /etc/pam.d/password-auth, just add 2 lines ( one is on top, and the one is at the end of the file)

auth        required      pam_mount.so
auth        required      pam_env.so

# ... file's other contents ...

session     optional      pam_winbind.so
session     optional      pam_mount.so

Step 3: Configure /etc/security/pam_mount.conf.xml

    <!-- pam_mount parameters: Volume-related -->
    <mkmountpoint enable="1" remove="true" />

    <volume user="*" fstype="cifs" server="fileserver" path="shared name of directory" mountpoint="/mnt/" options="sec=ntlm,nodev,nosuid" />
</pam_mount>

Remember : Disable SElinux.

  • 4
    I am not a fan of disabling SElinux. A fix shouldn't break anything else (in this case, security environment). – Deer Hunter Apr 13 '15 at 6:21
  • Unfortunately pam_mount clashes with default selinux settings on CentOS and requires some fine tuning with audit2allow or similar tools. Unfortunately this also changes with either selinux or pam_mount updates :(. For me it is enough hassle to look for alternatives. For encrypted volumes clevis & tang together with autofs seem to work well for me. For cifs I would likely look for kerberos authentication and autofs as well. – Tomek Apr 11 '19 at 6:46
  • DONT DISABLE SELINUX. That is the worst advice you could get and give. – Valentin Bajrami Aug 10 '19 at 7:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.