* Re: [PATCH 2/2, 2nd attempt] samples/auto.smb: add logic to obtain credentials
[not found] ` <1359549686-7246-3-git-send-email-martin.wilck@ts.fujitsu.com>
@ 2013-09-06 7:59 ` Ian Kent
2013-09-06 8:23 ` Martin Wilck
0 siblings, 1 reply; 5+ messages in thread
From: Ian Kent @ 2013-09-06 7:59 UTC (permalink / raw)
To: Martin Wilck; +Cc: autofs
On Wed, 2013-01-30 at 13:41 +0100, Martin Wilck wrote:
> In some environments, hosts will require credentials for a share
> listing.
>
> This patch introduces 2 methods to obtain credentials:
> 1) if a credentials file is present
> under /etc/creds/$key, use it.
> 2) Otherwise, try to find a usable kerberos credentials cache
> for the calling user (using the UID the script is running as)
> and use that.
> If both methods fail, the script will try to obtain the list
> of shares anonymously, falling back to the previous behavior.
> ---
> samples/auto.smb | 52 +++++++++++++++++++++++++++++++++++++++++++++++++++-
> 1 file changed, 51 insertions(+), 1 deletion(-)
>
> diff --git a/samples/auto.smb b/samples/auto.smb
> index 2dfb8f8..977b29b 100755
> --- a/samples/auto.smb
> +++ b/samples/auto.smb
> @@ -2,6 +2,40 @@
>
> # This file must be executable to work! chmod 755!
>
> +# Automagically mount CIFS shares in the network, similar to
> +# what autofs -hosts does for NFS.
> +
> +# Put a line like the following in /etc/auto.master:
> +# /cifs /etc/auto.smb --timeout=300
> +# You'll be able to access Windows and Samba shares in your network
> +# under /cifs/host.domain/share
> +
> +# "smbclient -L" is used to obtain a list of shares from the given host.
> +# In some environments, this requires valid credentials.
> +
> +# This script knows 2 methods to obtain credentials:
> +# 1) if a credentials file (see mount.cifs(8)) is present
> +# under /etc/creds/$key, use it.
> +# 2) Otherwise, try to find a usable kerberos credentials cache
> +# for the calling user and use that.
> +# If both methods fail, the script will try to obtain the list
> +# of shares anonymously.
> +
> +get_krb5_cache() {
> + cache=
> + uid=$(id -u)
> + for x in $(ls -d /run/user/$uid/krb5cc_* 2>/dev/null); do
> + if [ -d "$x" ] && klist -s DIR:"$x"; then
> + cache=DIR:$x
> + return
> + fi
> + done
> + if [ -f /tmp/krb5cc_$uid ] && klist -s /tmp/krb5cc_$uid; then
> + cache=/tmp/krb5cc_$uid
> + return
> + fi
> +}
> +
> key="$1"
> opts="-fstype=cifs"
>
> @@ -16,7 +50,23 @@ done
>
> [ -x $SMBCLIENT ] || exit 1
>
> -$SMBCLIENT -gNL $key 2>/dev/null| awk -v key="$key" -v opts="$opts" -F'|' -- '
> +creds=/etc/creds/$key
> +if [ -f "$creds" ]; then
> + opts="$opts"',uid=$UID,gid=$GID,credentials='"$creds"
> + smbopts="-A $creds"
> +else
> + get_krb5_cache
> + if [ -n "$cache" ]; then
> + opts="$opts"',multiuser,cruid=$UID,sec=krb5i'
> + smbopts="-k"
> + export KRB5CCNAME=$cache
> + else
> + opts="$opts"',guest'
Why add guest?
Is that going to change the behavior of the existing script.
> + smbopts="-N"
> + fi
> +fi
> +
> +$SMBCLIENT $smbopts -gL "$key" 2>/dev/null| awk -v "key=$key" -v "opts=$opts" -F '|' -- '
> BEGIN { ORS=""; first=1 }
> /Disk/ {
> if (first)
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH 2/2, 2nd attempt] samples/auto.smb: add logic to obtain credentials
2013-09-06 7:59 ` [PATCH 2/2, 2nd attempt] samples/auto.smb: add logic to obtain credentials Ian Kent
@ 2013-09-06 8:23 ` Martin Wilck
2013-09-06 9:26 ` Ian Kent
0 siblings, 1 reply; 5+ messages in thread
From: Martin Wilck @ 2013-09-06 8:23 UTC (permalink / raw)
To: Ian Kent; +Cc: autofs@vger.kernel.org
On 09/06/2013 09:59 AM, Ian Kent wrote:
>> -$SMBCLIENT -gNL $key 2>/dev/null| awk -v key="$key" -v opts="$opts" -F'|' -- '
>> +creds=/etc/creds/$key
>> +if [ -f "$creds" ]; then
>> + opts="$opts"',uid=$UID,gid=$GID,credentials='"$creds"
>> + smbopts="-A $creds"
>> +else
>> + get_krb5_cache
>> + if [ -n "$cache" ]; then
>> + opts="$opts"',multiuser,cruid=$UID,sec=krb5i'
>> + smbopts="-k"
>> + export KRB5CCNAME=$cache
>> + else
>> + opts="$opts"',guest'
>
> Why add guest?
"guest" means "don't prompt for a password" which is what mount.cifs
will attempt to do if no credentials are available already (e.g. via
kerberos ticket). IMO that's what's needed for autofs, otherwise the
mount attempt might hang waiting for password input.
> Is that going to change the behavior of the existing script.
"guest" mode was all the previous script could do, thus it seems to have
been written with servers in mind that only offered guest access in the
first place (und thus wouldn't prompt for a password, either).
Martin
--
Dr. Martin Wilck
PRIMERGY System Software Engineer
x86 Server Engineering
FUJITSU
Fujitsu Technology Solutions GmbH
Heinz-Nixdorf-Ring 1
33106 Paderborn, Germany
Phone: ++49 5251 525 2796
Fax: ++49 5251 525 2820
Email: martin.wilck@ts.fujitsu.com
Internet: http://ts.fujitsu.com
Company Details: http://ts.fujitsu.com/imprint
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH 2/2, 2nd attempt] samples/auto.smb: add logic to obtain credentials
2013-09-06 8:23 ` Martin Wilck
@ 2013-09-06 9:26 ` Ian Kent
2013-09-06 9:40 ` Martin Wilck
0 siblings, 1 reply; 5+ messages in thread
From: Ian Kent @ 2013-09-06 9:26 UTC (permalink / raw)
To: Martin Wilck; +Cc: autofs@vger.kernel.org
On Fri, 2013-09-06 at 10:23 +0200, Martin Wilck wrote:
> On 09/06/2013 09:59 AM, Ian Kent wrote:
>
> >> -$SMBCLIENT -gNL $key 2>/dev/null| awk -v key="$key" -v opts="$opts" -F'|' -- '
> >> +creds=/etc/creds/$key
> >> +if [ -f "$creds" ]; then
> >> + opts="$opts"',uid=$UID,gid=$GID,credentials='"$creds"
> >> + smbopts="-A $creds"
> >> +else
> >> + get_krb5_cache
> >> + if [ -n "$cache" ]; then
> >> + opts="$opts"',multiuser,cruid=$UID,sec=krb5i'
> >> + smbopts="-k"
> >> + export KRB5CCNAME=$cache
> >> + else
> >> + opts="$opts"',guest'
> >
> > Why add guest?
>
> "guest" means "don't prompt for a password" which is what mount.cifs
> will attempt to do if no credentials are available already (e.g. via
> kerberos ticket). IMO that's what's needed for autofs, otherwise the
> mount attempt might hang waiting for password input.
>
> > Is that going to change the behavior of the existing script.
>
> "guest" mode was all the previous script could do, thus it seems to have
> been written with servers in mind that only offered guest access in the
> first place (und thus wouldn't prompt for a password, either).
From my POV auto.smb is an example program map that happens to get
installed. I don't think it was never meant to be sophisticated.
You are saying that adding guest doesn't change anything as it is the
default when no credentials are provided, correct?
>
> Martin
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH 2/2, 2nd attempt] samples/auto.smb: add logic to obtain credentials
2013-09-06 9:26 ` Ian Kent
@ 2013-09-06 9:40 ` Martin Wilck
2013-09-07 7:29 ` Ian Kent
0 siblings, 1 reply; 5+ messages in thread
From: Martin Wilck @ 2013-09-06 9:40 UTC (permalink / raw)
To: Ian Kent; +Cc: autofs@vger.kernel.org
On 09/06/2013 11:26 AM, Ian Kent wrote:
> On Fri, 2013-09-06 at 10:23 +0200, Martin Wilck wrote:
>> On 09/06/2013 09:59 AM, Ian Kent wrote:
>>
>>>> -$SMBCLIENT -gNL $key 2>/dev/null| awk -v key="$key" -v opts="$opts" -F'|' -- '
>>>> +creds=/etc/creds/$key
>>>> +if [ -f "$creds" ]; then
>>>> + opts="$opts"',uid=$UID,gid=$GID,credentials='"$creds"
>>>> + smbopts="-A $creds"
>>>> +else
>>>> + get_krb5_cache
>>>> + if [ -n "$cache" ]; then
>>>> + opts="$opts"',multiuser,cruid=$UID,sec=krb5i'
>>>> + smbopts="-k"
>>>> + export KRB5CCNAME=$cache
>>>> + else
>>>> + opts="$opts"',guest'
>>>
>>> Why add guest?
>>
>> "guest" means "don't prompt for a password" which is what mount.cifs
>> will attempt to do if no credentials are available already (e.g. via
>> kerberos ticket). IMO that's what's needed for autofs, otherwise the
>> mount attempt might hang waiting for password input.
>>
>>> Is that going to change the behavior of the existing script.
>>
>> "guest" mode was all the previous script could do, thus it seems to have
>> been written with servers in mind that only offered guest access in the
>> first place (und thus wouldn't prompt for a password, either).
>
> From my POV auto.smb is an example program map that happens to get
> installed. I don't think it was never meant to be sophisticated.
Sure. We might as well keep it as it is, or just provide the new one
alongside the old one as another example.
> You are saying that adding guest doesn't change anything as it is the
> default when no credentials are provided, correct?
That's right.
Martin
--
Dr. Martin Wilck
PRIMERGY System Software Engineer
x86 Server Engineering
FUJITSU
Fujitsu Technology Solutions GmbH
Heinz-Nixdorf-Ring 1
33106 Paderborn, Germany
Phone: ++49 5251 525 2796
Fax: ++49 5251 525 2820
Email: martin.wilck@ts.fujitsu.com
Internet: http://ts.fujitsu.com
Company Details: http://ts.fujitsu.com/imprint
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH 2/2, 2nd attempt] samples/auto.smb: add logic to obtain credentials
2013-09-06 9:40 ` Martin Wilck
@ 2013-09-07 7:29 ` Ian Kent
0 siblings, 0 replies; 5+ messages in thread
From: Ian Kent @ 2013-09-07 7:29 UTC (permalink / raw)
To: Martin Wilck; +Cc: autofs@vger.kernel.org
On Fri, 2013-09-06 at 11:40 +0200, Martin Wilck wrote:
> On 09/06/2013 11:26 AM, Ian Kent wrote:
> > On Fri, 2013-09-06 at 10:23 +0200, Martin Wilck wrote:
> >> On 09/06/2013 09:59 AM, Ian Kent wrote:
> >>
> >>>> -$SMBCLIENT -gNL $key 2>/dev/null| awk -v key="$key" -v opts="$opts" -F'|' -- '
> >>>> +creds=/etc/creds/$key
> >>>> +if [ -f "$creds" ]; then
> >>>> + opts="$opts"',uid=$UID,gid=$GID,credentials='"$creds"
> >>>> + smbopts="-A $creds"
> >>>> +else
> >>>> + get_krb5_cache
> >>>> + if [ -n "$cache" ]; then
> >>>> + opts="$opts"',multiuser,cruid=$UID,sec=krb5i'
> >>>> + smbopts="-k"
> >>>> + export KRB5CCNAME=$cache
> >>>> + else
> >>>> + opts="$opts"',guest'
> >>>
> >>> Why add guest?
> >>
> >> "guest" means "don't prompt for a password" which is what mount.cifs
> >> will attempt to do if no credentials are available already (e.g. via
> >> kerberos ticket). IMO that's what's needed for autofs, otherwise the
> >> mount attempt might hang waiting for password input.
> >>
> >>> Is that going to change the behavior of the existing script.
> >>
> >> "guest" mode was all the previous script could do, thus it seems to have
> >> been written with servers in mind that only offered guest access in the
> >> first place (und thus wouldn't prompt for a password, either).
> >
> > From my POV auto.smb is an example program map that happens to get
> > installed. I don't think it was never meant to be sophisticated.
>
> Sure. We might as well keep it as it is, or just provide the new one
> alongside the old one as another example.
Maybe, but, having looked more closely at it, it should still function
as it did previously so I'm inclined to add the patch.
>
> > You are saying that adding guest doesn't change anything as it is the
> > default when no credentials are provided, correct?
>
> That's right.
>
> Martin
>
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2013-09-07 7:29 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <51081EF4.20105@ts.fujitsu.com>
[not found] ` <1359549686-7246-1-git-send-email-martin.wilck@ts.fujitsu.com>
[not found] ` <1359549686-7246-3-git-send-email-martin.wilck@ts.fujitsu.com>
2013-09-06 7:59 ` [PATCH 2/2, 2nd attempt] samples/auto.smb: add logic to obtain credentials Ian Kent
2013-09-06 8:23 ` Martin Wilck
2013-09-06 9:26 ` Ian Kent
2013-09-06 9:40 ` Martin Wilck
2013-09-07 7:29 ` Ian Kent
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.