[Samba] Pam_mount not working with "sec=krb5"

[Ole Traupe]

Am 02.11.2015 um 13:12 schrieb buhorojo:
> On 02/11/15 12:54, Ole Traupe wrote:
>> Hi all, this is not really a Samba question, but related, and I hope 
>> that some of you are using this and can tell me what I am doing wrong.
>>
>> On a member server, I can mount my shares by hand specifying "-o 
>> username=xxx,domain=yyy,password=zzz". But as soon as I put 
>> "sec=krb5" in the mount options (and leaving out the password part), 
>> I get this error:
>>
>> # mount error(126): Required key not available
>>
>> I did an extensive web search and saw that many people have problems 
>> here. But I found no definite solution. I tried to specify 
>> 'cruid=%(USERID)' in the case of pam_mount, or 'cruid=12345' in the 
>> manual case (12345 being the literal uid of the user). I also tried 
>> getting rid of the strange file ending of the krb5 key cache, because 
>> in my case it is e.g. "krb5cc_12345_Zb1yLU". And I tried chowning the 
>> file to root:root instead of user:domain users. Nothing worked.
>>
>> The krb5 key cache files are created in /tmp on user logon. Is this 
>> the correct lookup directory, in the first place?
>>
>> Kerberos as such is working correctly. Domain logons work, kinit as 
>> well. This is on CentOS 6.7. Pam_mount was installed via the Nux 
>> Desktop repo.
>>
>> Best,
>> Ole
>>
>>
>>
> Hi
> You need multiuser.
>
> Either use a key you already have:
> mount -t cifs //yourserver/share /share -osec=krb5, 
> username=MACHINE$,multiuser
>
> Or create an unprivileged domain user to mount the shares and add that 
> key to the keytab. Use the mutiuser switch to mount the share on 
> behalf of anyone who needs it:
> mount -t cifs //yourserver/share /share -osec=krb5, 
> username=user4cifs,multiuser
>
> We recommend the second method as the first way is easy to hack.
> HTH

Thank you, I will try this! However, I am not sure I understand why it 
is necessary and whether it works as intended. Why can't the user do it 
with his own key file?

Also, if the user is not mounting his home share, but somebody else, 
this _other_ user will be the owner of newly created files and folders, 
right?