How to test multiusermount?

How to test multiusermount?

[Stef Bon]

Hi,

I would like to test the multiusermounts?

I know to set:

 echo 1 > /proc/fs/cifs/MultiuserMount

and add an option to the mount command, but I can remember/read somewhere
that one have to add some mapping somehwere:

local user : remote user
...

Is this correct?

Stef Bon

Re: How to test multiusermount?

[Steve French]

Jeff has a writeup that explains it more nicely but don't have the
link in front of me.  Note that it works best with Kerberos (sec=krb5
or sec=krb5i)

On Mon, Oct 31, 2011 at 6:12 PM, Stef Bon <stefbon-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:
> Hi,
>
> I would like to test the multiusermounts?
>
> I know to set:
>
>  echo 1 > /proc/fs/cifs/MultiuserMount
>
> and add an option to the mount command, but I can remember/read somewhere
> that one have to add some mapping somehwere:
>
> local user : remote user
> ...
>
> Is this correct?
>
> Stef Bon
> --
> To unsubscribe from this list: send the line "unsubscribe linux-cifs" in
> the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>



-- 
Thanks,

Steve

Re: How to test multiusermount?

[Jeff Layton]

On Tue, 1 Nov 2011 00:12:21 +0100
Stef Bon <stefbon-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:

> Hi,
> 
> I would like to test the multiusermounts?
> 
> I know to set:
> 
>  echo 1 > /proc/fs/cifs/MultiuserMount
> 
> and add an option to the mount command, but I can remember/read somewhere
> that one have to add some mapping somehwere:
> 
> local user : remote user
> ...
> 
> Is this correct?
> 

No. The MultiuserMount code that the above switch activates is
basically deprecated (and never worked very well in the first place).
The correct way to do this is to use sec=krb5 and mount with '-o
multiuser'. Then, make sure all users accessing the mount have a TGT.

If you're using unix extensions (generally meaning that the remote
server is samba-based), then having unity-mapped uids is helpful.

-- 
Jeff Layton <jlayton-eUNUBHrolfbYtjvyW6yDsg@public.gmane.org>

Re: How to test multiusermount?

[Stef Bon]

Hi,

thanks,

but what are unity mapped uids? Uids coming from a shared db like ldap and ads?

Stef

Re: How to test multiusermount?

[Jeff Layton]

On Wed, 2 Nov 2011 16:56:05 +0100
Stef Bon <stefbon-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:

> Hi,
> 
> thanks,
> 
> but what are unity mapped uids? Uids coming from a shared db like ldap and ads?
> 

That just means that the client and server need to have identically
mapped uid/gid's. For instance, user1 on the client needs to have the
same uid as user1 on the server.

-- 
Jeff Layton <jlayton-eUNUBHrolfbYtjvyW6yDsg@public.gmane.org>

Re: How to test multiusermount?

[Suresh Jayaraman]

On 11/01/2011 03:34 PM, Jeff Layton wrote:
> On Tue, 1 Nov 2011 00:12:21 +0100
> Stef Bon <stefbon-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:
> 
>> Hi,
>>
>> I would like to test the multiusermounts?
>>
>> I know to set:
>>
>>  echo 1 > /proc/fs/cifs/MultiuserMount
>>
>> and add an option to the mount command, but I can remember/read somewhere
>> that one have to add some mapping somehwere:
>>
>> local user : remote user
>> ...
>>
>> Is this correct?
>>
> 
> No. The MultiuserMount code that the above switch activates is
> basically deprecated (and never worked very well in the first place).

So, time for planning its good riddance?

> The correct way to do this is to use sec=krb5 and mount with '-o
> multiuser'. Then, make sure all users accessing the mount have a TGT.
> 
> If you're using unix extensions (generally meaning that the remote
> server is samba-based), then having unity-mapped uids is helpful.
> 

Re: How to test multiusermount?

[Steve French]

On Fri, Nov 4, 2011 at 12:34 AM, Suresh Jayaraman <sjayaraman-IBi9RG/b67k@public.gmane.org> wrote:
> On 11/01/2011 03:34 PM, Jeff Layton wrote:
>> On Tue, 1 Nov 2011 00:12:21 +0100
>> Stef Bon <stefbon-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:
>>
>>> Hi,
>>>
>>> I would like to test the multiusermounts?
>>>
>>> I know to set:
>>>
>>>  echo 1 > /proc/fs/cifs/MultiuserMount
>>>
>>> and add an option to the mount command, but I can remember/read somewhere
>>> that one have to add some mapping somehwere:
>>>
>>> local user : remote user
>>> ...
>>>
>>> Is this correct?
>>>
>>
>> No. The MultiuserMount code that the above switch activates is
>> basically deprecated (and never worked very well in the first place).
>
> So, time for planning its good riddance?

Mainly waiting for some way to have ntlmv2 enablement of multiuser
mount (krb5 only is too restrictive).



-- 
Thanks,

Steve

Re: How to test multiusermount?

[Jeff Layton]

On Fri, 4 Nov 2011 00:56:16 -0500
Steve French <smfrench-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:

> On Fri, Nov 4, 2011 at 12:34 AM, Suresh Jayaraman <sjayaraman-WDPRK7U/wSs@public.gmane.orgm> wrote:
> > On 11/01/2011 03:34 PM, Jeff Layton wrote:
> >> On Tue, 1 Nov 2011 00:12:21 +0100
> >> Stef Bon <stefbon-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:
> >>
> >>> Hi,
> >>>
> >>> I would like to test the multiusermounts?
> >>>
> >>> I know to set:
> >>>
> >>>  echo 1 > /proc/fs/cifs/MultiuserMount
> >>>
> >>> and add an option to the mount command, but I can remember/read somewhere
> >>> that one have to add some mapping somehwere:
> >>>
> >>> local user : remote user
> >>> ...
> >>>
> >>> Is this correct?
> >>>
> >>
> >> No. The MultiuserMount code that the above switch activates is
> >> basically deprecated (and never worked very well in the first place).
> >
> > So, time for planning its good riddance?
> 
> Mainly waiting for some way to have ntlmv2 enablement of multiuser
> mount (krb5 only is too restrictive).
> 

Right. The new multiuser code only works with krb5 so far. I 
think in order to deprecate the old code, we need to do the following:

1) the cifscreds program in cifs-utils will need to be cleaned up and
completed. This would allow users to stash their NTLM creds in the
kernel's keyring. This includes username and password, and some info
about which creds should be used with which servers (or NT domains).
The existing format for stashing those creds is probably not what we
need so this is a bit of work and redesign I think.

2) code will need to be added to the kernel to fetch NTLM auth info out
of the kernel keyring for establishing new sessions.

3) better documentation for multiuser mounts. This is always an issue,
but multiuser is more complicated so we'll really need this.

At that point, I think we can schedule the old multiuser code for
deprecation.

-- 
Jeff Layton <jlayton-eUNUBHrolfbYtjvyW6yDsg@public.gmane.org>

Re: How to test multiusermount?

[Steve French]

On Fri, Nov 4, 2011 at 9:02 AM, Jeff Layton <jlayton-eUNUBHrolfbYtjvyW6yDsg@public.gmane.org> wrote:
> On Fri, 4 Nov 2011 00:56:16 -0500
> Steve French <smfrench-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:
>
>> On Fri, Nov 4, 2011 at 12:34 AM, Suresh Jayaraman <sjayaraman@suse.com> wrote:
>> > On 11/01/2011 03:34 PM, Jeff Layton wrote:
>> >> On Tue, 1 Nov 2011 00:12:21 +0100
>> >> Stef Bon <stefbon-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:
>> >>
>> >>> Hi,
>> >>>
>> >>> I would like to test the multiusermounts?
>> >>>
>> >>> I know to set:
>> >>>
>> >>>  echo 1 > /proc/fs/cifs/MultiuserMount
>> >>>
>> >>> and add an option to the mount command, but I can remember/read somewhere
>> >>> that one have to add some mapping somehwere:
>> >>>
>> >>> local user : remote user
>> >>> ...
>> >>>
>> >>> Is this correct?
>> >>>
>> >>
>> >> No. The MultiuserMount code that the above switch activates is
>> >> basically deprecated (and never worked very well in the first place).
>> >
>> > So, time for planning its good riddance?
>>
>> Mainly waiting for some way to have ntlmv2 enablement of multiuser
>> mount (krb5 only is too restrictive).
>>
>
> Right. The new multiuser code only works with krb5 so far. I
> think in order to deprecate the old code, we need to do the following:
>
> 1) the cifscreds program in cifs-utils will need to be cleaned up and
> completed. This would allow users to stash their NTLM creds in the
> kernel's keyring. This includes username and password, and some info
> about which creds should be used with which servers (or NT domains).
> The existing format for stashing those creds is probably not what we
> need so this is a bit of work and redesign I think.
>
> 2) code will need to be added to the kernel to fetch NTLM auth info out
> of the kernel keyring for establishing new sessions.
>
> 3) better documentation for multiuser mounts. This is always an issue,
> but multiuser is more complicated so we'll really need this.
>
> At that point, I think we can schedule the old multiuser code for
> deprecation.

Yes.  Also note probable need for optional winbind integration
to fetch creds (or winbind -> kernel keyring tie so we can get
at these creds as needed)

-- 
Thanks,

Steve

Re: How to test multiusermount?

[Jeff Layton]

On Fri, 4 Nov 2011 11:25:43 -0500
Steve French <smfrench-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:

> On Fri, Nov 4, 2011 at 9:02 AM, Jeff Layton <jlayton-eUNUBHrolfbYtjvyW6yDsg@public.gmane.org> wrote:
> > On Fri, 4 Nov 2011 00:56:16 -0500
> > Steve French <smfrench-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:
> >
> >> On Fri, Nov 4, 2011 at 12:34 AM, Suresh Jayaraman <sjayaraman@suse.com> wrote:
> >> > On 11/01/2011 03:34 PM, Jeff Layton wrote:
> >> >> On Tue, 1 Nov 2011 00:12:21 +0100
> >> >> Stef Bon <stefbon-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:
> >> >>
> >> >>> Hi,
> >> >>>
> >> >>> I would like to test the multiusermounts?
> >> >>>
> >> >>> I know to set:
> >> >>>
> >> >>>  echo 1 > /proc/fs/cifs/MultiuserMount
> >> >>>
> >> >>> and add an option to the mount command, but I can remember/read somewhere
> >> >>> that one have to add some mapping somehwere:
> >> >>>
> >> >>> local user : remote user
> >> >>> ...
> >> >>>
> >> >>> Is this correct?
> >> >>>
> >> >>
> >> >> No. The MultiuserMount code that the above switch activates is
> >> >> basically deprecated (and never worked very well in the first place).
> >> >
> >> > So, time for planning its good riddance?
> >>
> >> Mainly waiting for some way to have ntlmv2 enablement of multiuser
> >> mount (krb5 only is too restrictive).
> >>
> >
> > Right. The new multiuser code only works with krb5 so far. I
> > think in order to deprecate the old code, we need to do the following:
> >
> > 1) the cifscreds program in cifs-utils will need to be cleaned up and
> > completed. This would allow users to stash their NTLM creds in the
> > kernel's keyring. This includes username and password, and some info
> > about which creds should be used with which servers (or NT domains).
> > The existing format for stashing those creds is probably not what we
> > need so this is a bit of work and redesign I think.
> >
> > 2) code will need to be added to the kernel to fetch NTLM auth info out
> > of the kernel keyring for establishing new sessions.
> >
> > 3) better documentation for multiuser mounts. This is always an issue,
> > but multiuser is more complicated so we'll really need this.
> >
> > At that point, I think we can schedule the old multiuser code for
> > deprecation.
> 
> Yes.  Also note probable need for optional winbind integration
> to fetch creds (or winbind -> kernel keyring tie so we can get
> at these creds as needed)
> 

That's a nice-to-have, and something that can be added after we have
basic support for NTLM credential stashing in the kernel.

Cheers,
-- 
Jeff Layton <jlayton-eUNUBHrolfbYtjvyW6yDsg@public.gmane.org>