0

I have an RHEL (7.9) server with a remote drive mounted as a multiuser CIFS volume. With multiuser CIFS shares, users need to execute an additional command (cifscreds add) in order to access it. This basically stores the user's password in the Linux keyring.

I found and implemented a solution to do this (initiate the keyring and store the password when the user logs in via SSH into the server. This is done through the pam_cifscreds module. Following lines were added to /etc/pam.d/sshd to get it to work:

auth        optional       pam_cifscreds.so     
.
.
session    required     pam_keyinit.so force revoke
session    required     pam_cifscreds.so        domain=XYZ 
.
.

It is working fine when the user SSH's in the server. They are able to access the mount without running the aforementioned command explicitly.

Now I have another scenario : User logs in with the superuser, and sudo to the person user: for e.g., log in using root and sudo to 'user123'. In this case, user123 should be able to access the CIFS share.

I tried to add the same lines into /etc/pam.d/sudo and /etc/pam.d/su - but it does not work. Logs from /var/log/secure indicate that the pam module is unable to find the password for user123.

Can someone please advise if it is possible to use pam_cifscreds with sudo access

1 Answer 1

0

This cannot possibly work, because neither su nor sudo know the password of user123, so they aren't able to provide it to the PAM modules. (When called as root, the authentication step is skipped completely.)

You will need to continue using cifscreds add after entering user123's shell.

Use keyctl show to confirm that the keyring has been set up and that it has the correct entries.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.