summaryrefslogtreecommitdiffstats
path: root/data/ad/mountscript
diff options
context:
space:
mode:
Diffstat (limited to 'data/ad/mountscript')
-rw-r--r--data/ad/mountscript60
1 files changed, 34 insertions, 26 deletions
diff --git a/data/ad/mountscript b/data/ad/mountscript
index 4fa5f36..4812b1e 100644
--- a/data/ad/mountscript
+++ b/data/ad/mountscript
@@ -4,50 +4,58 @@
# and is not stand-alone!
#
+VOLUME=
+REAL_ACCOUNT=
if ! grep -q "^${PAM_USER}:" "/etc/passwd"; then
-
- if [ -z "$VOLUME" -o -z "$REAL_ACCOUNT" ]; then
- # determine fileserver and share for home directories
- touch "/tmp/ldapsearch.${PAM_USER}"
- chmod 0600 "/tmp/ldapsearch.${PAM_USER}"
- ldapsearch -x -LLL uid="${PAM_USER}" homeMount realAccount > "/tmp/ldapsearch.${PAM_USER}" 2>/dev/null || \
- { slxlog "pam-ad-ldapquery" "Could not query LDAP server for parameters of user '${PAM_USER}'."; exit 1; }
- VOLUME=$(cat "/tmp/ldapsearch.${PAM_USER}" | grep ^homeMount | head -n 1 | cut -d" " -f2)
- [ -z "${VOLUME}" ] && slxlog "pam-ad-ldapvolume" "LDAP server did not provide 'homeMount'. Aborting mount for ${PAM_USER}." && exit 1
- [ -z "$REAL_ACCOUNT" ] && REAL_ACCOUNT=$(cat "/tmp/ldapsearch.${PAM_USER}" | grep ^realAccount | head -n 1 | cut -d" " -f2)
- [ -z "$REAL_ACCOUNT" ] && REAL_ACCOUNT="$PAM_USER"
+ # determine fileserver and share for home directories
+ BINDDN=$(ldapsearch -l 3 -o nettimeout=3 -o ldif-wrap=no -x -LLL uid="${PAM_USER}" dn distinguishedName | grep -E '^(dn|distinguishedName):' | head -n 1 | cut -d ' ' -f 2)
+ if [ -z "$BINDDN" ]; then
+ slxlog "pam-ad-ldapquery" "Could not query DN of user ${PAM_USER}. No home directory available"
+ else
+ RESULT=$(mktemp)
+ PW="/tmp/pw.${RANDOM}.${RANDOM}.${PAM_USER}.${RANDOM}"
+ mkfifo -m 0600 "${PW}" || slxlog "pam-ad-fifo" "Could not create FIFO at ${PW}"
+ ( echo "${PAM_AUTHTOK}" > "${PW}" ) &
+ ldapsearch -y "${PW}" -D "$BINDDN" -l 5 -o nettimeout=5 -o ldif-wrap=no -x -LLL uid="${PAM_USER}" homeMount realAccount > "${RESULT}" 2>/dev/null \
+ || slxlog "pam-ad-ldapquery" "Could not query LDAP-AD-Proxy for parameters of user '${PAM_USER}'."
+ rm -f -- "${PW}"
+ VOLUME=$(cat "${RESULT}" | grep '^homeMount:' | head -n 1 | cut -d ' ' -f 2)
+ [ -z "${VOLUME}" ] && slxlog "pam-ad-ldapvolume" "AD/Proxy did not provide 'homeMount'. Aborting mount for ${PAM_USER}."
+ [ -z "$REAL_ACCOUNT" ] && REAL_ACCOUNT=$(cat "${RESULT}" | grep '^realAccount:' | head -n 1 | cut -d ' ' -f 2)
+ [ -z "$REAL_ACCOUNT" ] && REAL_ACCOUNT="${PAM_USER}"
fi
-
- MOUNT_OPTS="-v -t cifs -o uid=${USER_UID},gid=${USER_GID},forceuid,forcegid,sec=ntlm"
-
- SIGNAL=$(mktemp)
- rm -f -- "${SIGNAL}"
-
+fi
+
+if [ -n "${VOLUME}" ]; then
+ MOUNT_OPTS="-v -t cifs -o uid=${USER_UID},gid=${USER_GID},forceuid,forcegid,sec=ntlm,nounix,file_mode=0700,dir_mode=0700"
+ SIGNAL="/tmp/signal.${RANDOM}.${RANDOM}.${PAM_USER}.${RANDOM}"
+
export USER="${REAL_ACCOUNT}"
export PASSWD="${PAM_AUTHTOK}"
-
- ( mount ${MOUNT_OPTS} "${VOLUME}" "${PERSISTENT_HOME_DIR}" > "/tmp/home.$PAM_USER" 2>&1 || touch "${SIGNAL}" ) &
+
+ ( mount ${MOUNT_OPTS} "${VOLUME}" "${PERSISTENT_HOME_DIR}" > "${RESULT}" 2>&1 || touch "${SIGNAL}" ) &
MOUNT_PID=$!
for COUNTER in 1 2 4 4; do
kill -0 "${MOUNT_PID}" 2>/dev/null || break
sleep "${COUNTER}"
done
-
+
if [ -e "${SIGNAL}" ]; then
- slxlog "pam-ad-mount" "Mount of '${VOLUME}' to '${PERSISTENT_HOME_DIR}' failed. (Args: ${MOUNT_OPTS})" "/tmp/home.$PAM_USER"
+ slxlog "pam-ad-mount" "Mount of '${VOLUME}' to '${PERSISTENT_HOME_DIR}' failed. (Args: ${MOUNT_OPTS})" "${RESULT}"
sleep 1
rm -f -- "${SIGNAL}"
elif kill -9 "${MOUNT_PID}" 2>/dev/null; then
- slxlog "pam-ad-mount" "Mount of '${VOLUME}' to '${PERSISTENT_HOME_DIR}' timed out. (Args: ${MOUNT_OPTS})" "/tmp/home.$PAM_USER"
+ slxlog "pam-ad-mount" "Mount of '${VOLUME}' to '${PERSISTENT_HOME_DIR}' timed out. (Args: ${MOUNT_OPTS})" "${RESULT}"
sleep 1
else
PERSISTENT_OK=yes
- chmod -R u+rw "${PERSISTENT_HOME_DIR}" 2>/dev/null
+ chmod -R u+rwX "${PERSISTENT_HOME_DIR}" 2>/dev/null
fi
-
+
unset USER
unset PASSWD
-
- rm -f -- "/tmp/home.$PAM_USER"
fi
+[ -n "${RESULT}" ] && rm -f -- "${RESULT}"
+true
+