I have an RHEL (7.9) server with a remote drive mounted as a multiuser CIFS volume. With multiuser CIFS shares, users need to execute an additional command (
cifscreds add) in order to access it. This basically stores the user's password in the Linux keyring.
I found and implemented a solution to do this (initiate the keyring and store the password when the user logs in via SSH into the server. This is done through the pam_cifscreds module. Following lines were added to /etc/pam.d/sshd to get it to work:
auth optional pam_cifscreds.so . . session required pam_keyinit.so force revoke session required pam_cifscreds.so domain=XYZ . .
It is working fine when the user SSH's in the server. They are able to access the mount without running the aforementioned command explicitly.
Now I have another scenario : User logs in with the superuser, and sudo to the person user: for e.g., log in using root and sudo to 'user123'. In this case, user123 should be able to access the CIFS share.
I tried to add the same lines into /etc/pam.d/sudo and /etc/pam.d/su - but it does not work. Logs from /var/log/secure indicate that the pam module is unable to find the password for user123.
Can someone please advise if it is possible to use pam_cifscreds with sudo access