2018-network-home-directories-autofs
The Slovak original of this document: 2018-network-home-directories-autofs (slovensky).
Networked home directories in Linux
1 Úvod
This short article is about mounting users' networked (CIFS) home directories on a server (Server3) automatically with the automounter (AUTOFS), where the home directories are served by another machine (Server2) running SAMBA. A home directory is mounted only after Kerberos authentication has succeeded. It follows that the users and both servers have to be able to work with Kerberos tickets, since the mounting server (Server3) uses the user's Kerberos ticket to authenticate to the SAMBA server (Server2). The simplest way to arrange that is to join both servers to a Windows domain and keep the users in Microsoft Active Directory — which is why a Windows server (Server1) running Microsoft Active Directory also appears here, holding the Windows domain DOMENA.SK. RHEL 7.4 was used for the testing.
2 Komponenty
Server1 (domain controller) - This server acts as the Microsoft Active Directory server, that is, as the domain controller.
Server2 (file server) - This server serves networked home directories, with CIFS (Common Internet File System) as the network file system. SAMBA does the work. The server is joined to the Windows domain DOMENA.SK.
Server3 (user server) - This is the machine users connect to over SSH or SCP, and where their networked home directories are mounted. The automounter (AUTOFS) does the mounting. The server is joined to the Windows domain DOMENA.SK, and SSSD integrates it with Microsoft Active Directory.
Note 1: Installing and configuring Active Directory (Server1) is not the subject of this article.
Note 2: Integrating Linux servers with Microsoft Active Directory (the SSSD software) is not the subject of this article.
3 The file server (Server2)
3.1 Installing what is needed (SAMBA)
# yum install samba
3.2 Configuring SAMBA
Creating the directory structure for the users' home directories.
# mkdir -p /homedirs/user1 # mkdir -p /homedirs/user2 # mkdir -p /homedirs/User3 ...
Changing the permissions on the users' home directories.
# chown user1:group /homedirs/user1 # chmod 0700 /homedirs/user1 # chown user2:group /homedirs/user2 # chmod 0700 /homedirs/user2 # chown user3:group /homedirs/user3 # chmod 0700 /homedirs/user3 ...
Configuring SAMBA.
# vi /etc/samba/smb.conf
-------------------------------------------------------------------------
[global]
workgroup = DOMENA
client signing = yes
client use spnego = yes
server signing = mandatory
kerberos method = secrets and keytab
log file = /var/log/samba/log.%m
log level = 0
realm = DOMENA.SK
security = ads
[homedirs]
comment = Users Network home directories
path = /homedirs
writable = yes
read only = no
force create mode = 0600
create mask = 0700
directory mask = 0700
force directory mode = 0700
access based share enum = yesStarting SAMBA.
# systemctl start smb
Starting SAMBA at boot.
# systemctl enable smb
4 The user server (Server3) - variant 1
Variant 1 is the case where whole home directories are mounted on the user server directly under /home/, so the user part of /home/user lives on the file server.
4.1 Installing what is needed (AUTOFS)
# yum install autofs # yum install cifs-utils
4.2 User space - "request-key" and "cifs.upcall"
Mounting the CIFS network filesystem with Kerberos authentication needs the right user-space configuration. The reason is that when the kernel mounts a CIFS filesystem it needs the Kerberos tickets, and those live in user space (by default under /tmp). To get them, the kernel runs the program request-key, which reads /etc/request-key.conf to learn what to do with the request and how to reach the tickets. For a CIFS mount with Kerberos authentication, request-key runs the helper cifs-upcall.
4.2.1 Checking the system for the configuration user space needs
Check whether the system has the user-space configuration it needs. On RHEL 7 none is required, because installing the cifs-utils package brings it. All we need here is the file cifs.spnego, because we authenticate through SPNEGO (the Windows domain, Kerberised).
# ls -lh /etc/request-key.d/ ------------------------------------------------------------------------- -rw-r--r-- 1 root root 50 Apr 3 2017 cifs.idmap.conf -rw-r--r-- 1 root root 52 Nov 23 17:04 cifs.spnego.conf
4.2.2 Adjusting the configuration in user space
If the files from 4.2.1 exist, adjust the configuration by adding the -t switch.
# vi /etc/request-key.d/cifs.spnego.conf ------------------------------------------------------------------------- ORIGINAL: create cifs.spnego * * /usr/sbin/cifs.upcall %k CHANGED : create cifs.spnego * * /usr/sbin/cifs.upcall -t %k
4.2.3 Creating the configuration in user space
If the files from 4.2.1 do not exist, create the configuration by adding to /etc/request-key.conf.
# vi /etc/request-key.conf ------------------------------------------------------------------------- ... # LH-ON create cifs.idmap * * /usr/sbin/cifs.idmap %k create cifs.spnego * * /usr/sbin/cifs.upcall -t %k
4.3 Configuring the automounter (AUTOFS)
Editing the AUTOFS master configuration file.
# vi /etc/auto.master ------------------------------------------------------------------------- +auto.master ... # Mount point | detailed instructions | further parameters. # ktoreho chceme | are here. | # pripojit. | | /home /etc/auto.cifshome --timeout 20
Creating a specific configuration file, with detailed mount instructions, for mounting the networked home directories.
# vi /etc/auto.cifshome ------------------------------------------------------------------------- * -fstype=cifs,sec=krb5i,uid=$UID,gid=$GID,cruid=$UID,file_mode=0600,dir_mode=0700 ://CIFS_SERVER/homedirs/&
4 The user server (Server3) - variant 2
Variant 2 is the case where whole home directories are mounted on the user server directly at /home/user.
3.2 Configuring AUTOFS
Because AUTOFS is limited in how it can use wildcards in