Always include home-mount-script in ad module; add support for fetching homedir-server directly from AD

1 files changed, 34 insertions, 26 deletions

diff --git a/data/ad/mountscript b/data/ad/mountscript
index 4fa5f36..4812b1e 100644
--- a/data/ad/mountscript
+++ b/data/ad/mountscript
@@ -4,50 +4,58 @@
 #       and is not stand-alone!
 #
 
+VOLUME=
+REAL_ACCOUNT=
 if ! grep -q "^${PAM_USER}:" "/etc/passwd"; then
-	
-	if [ -z "$VOLUME" -o -z "$REAL_ACCOUNT" ]; then
-		# determine fileserver and share for home directories
-		touch "/tmp/ldapsearch.${PAM_USER}"
-		chmod 0600 "/tmp/ldapsearch.${PAM_USER}"
-		ldapsearch -x -LLL uid="${PAM_USER}" homeMount realAccount > "/tmp/ldapsearch.${PAM_USER}" 2>/dev/null || \
-			{ slxlog "pam-ad-ldapquery" "Could not query LDAP server for parameters of user '${PAM_USER}'."; exit 1; }
-		VOLUME=$(cat "/tmp/ldapsearch.${PAM_USER}" | grep ^homeMount | head -n 1 | cut -d" " -f2)
-		[ -z "${VOLUME}" ] && slxlog "pam-ad-ldapvolume" "LDAP server did not provide 'homeMount'. Aborting mount for ${PAM_USER}." && exit 1
-		[ -z "$REAL_ACCOUNT" ] && REAL_ACCOUNT=$(cat "/tmp/ldapsearch.${PAM_USER}" | grep ^realAccount | head -n 1 | cut -d" " -f2)
-		[ -z "$REAL_ACCOUNT" ] && REAL_ACCOUNT="$PAM_USER"
+	# determine fileserver and share for home directories
+	BINDDN=$(ldapsearch -l 3 -o nettimeout=3 -o ldif-wrap=no -x -LLL uid="${PAM_USER}" dn distinguishedName | grep -E '^(dn|distinguishedName):' | head -n 1 | cut -d ' ' -f 2)
+	if [ -z "$BINDDN" ]; then
+		slxlog "pam-ad-ldapquery" "Could not query DN of user ${PAM_USER}. No home directory available"
+	else
+		RESULT=$(mktemp)
+		PW="/tmp/pw.${RANDOM}.${RANDOM}.${PAM_USER}.${RANDOM}"
+		mkfifo -m 0600 "${PW}" || slxlog "pam-ad-fifo" "Could not create FIFO at ${PW}"
+		( echo "${PAM_AUTHTOK}" > "${PW}" ) &
+		ldapsearch -y "${PW}" -D "$BINDDN" -l 5 -o nettimeout=5 -o ldif-wrap=no -x -LLL uid="${PAM_USER}" homeMount realAccount > "${RESULT}" 2>/dev/null \
+			|| slxlog "pam-ad-ldapquery" "Could not query LDAP-AD-Proxy for parameters of user '${PAM_USER}'."
+		rm -f -- "${PW}"
+		VOLUME=$(cat "${RESULT}" | grep '^homeMount:' | head -n 1 | cut -d ' ' -f 2)
+		[ -z "${VOLUME}" ] && slxlog "pam-ad-ldapvolume" "AD/Proxy did not provide 'homeMount'. Aborting mount for ${PAM_USER}."
+		[ -z "$REAL_ACCOUNT" ] && REAL_ACCOUNT=$(cat "${RESULT}" | grep '^realAccount:' | head -n 1 | cut -d ' ' -f 2)
+		[ -z "$REAL_ACCOUNT" ] && REAL_ACCOUNT="${PAM_USER}"
 	fi
-	
-	MOUNT_OPTS="-v -t cifs -o uid=${USER_UID},gid=${USER_GID},forceuid,forcegid,sec=ntlm"
-	
-	SIGNAL=$(mktemp)
-	rm -f -- "${SIGNAL}"
-	
+fi
+
+if [ -n "${VOLUME}" ]; then
+	MOUNT_OPTS="-v -t cifs -o uid=${USER_UID},gid=${USER_GID},forceuid,forcegid,sec=ntlm,nounix,file_mode=0700,dir_mode=0700"
+	SIGNAL="/tmp/signal.${RANDOM}.${RANDOM}.${PAM_USER}.${RANDOM}"
+
 	export USER="${REAL_ACCOUNT}"
 	export PASSWD="${PAM_AUTHTOK}"
-	
-	( mount ${MOUNT_OPTS} "${VOLUME}" "${PERSISTENT_HOME_DIR}" > "/tmp/home.$PAM_USER" 2>&1 || touch "${SIGNAL}" ) &
+
+	( mount ${MOUNT_OPTS} "${VOLUME}" "${PERSISTENT_HOME_DIR}" > "${RESULT}" 2>&1 || touch "${SIGNAL}" ) &
 	MOUNT_PID=$!
 	for COUNTER in 1 2 4 4; do
 		kill -0 "${MOUNT_PID}" 2>/dev/null || break
 		sleep "${COUNTER}"
 	done
-	
+
 	if [ -e "${SIGNAL}" ]; then
-		slxlog "pam-ad-mount" "Mount of '${VOLUME}' to '${PERSISTENT_HOME_DIR}' failed. (Args: ${MOUNT_OPTS})" "/tmp/home.$PAM_USER"
+		slxlog "pam-ad-mount" "Mount of '${VOLUME}' to '${PERSISTENT_HOME_DIR}' failed. (Args: ${MOUNT_OPTS})" "${RESULT}"
 		sleep 1
 		rm -f -- "${SIGNAL}"
 	elif kill -9 "${MOUNT_PID}" 2>/dev/null; then
-		slxlog "pam-ad-mount" "Mount of '${VOLUME}' to '${PERSISTENT_HOME_DIR}' timed out. (Args: ${MOUNT_OPTS})" "/tmp/home.$PAM_USER"
+		slxlog "pam-ad-mount" "Mount of '${VOLUME}' to '${PERSISTENT_HOME_DIR}' timed out. (Args: ${MOUNT_OPTS})" "${RESULT}"
 		sleep 1
 	else
 		PERSISTENT_OK=yes
-		chmod -R u+rw "${PERSISTENT_HOME_DIR}" 2>/dev/null
+		chmod -R u+rwX "${PERSISTENT_HOME_DIR}" 2>/dev/null
 	fi
-	
+
 	unset USER
 	unset PASSWD
-	
-	rm -f -- "/tmp/home.$PAM_USER"
 fi
 
+[ -n "${RESULT}" ] && rm -f -- "${RESULT}"
+true
+