diff options
Diffstat (limited to 'data/ad/mountscript')
| -rw-r--r-- | data/ad/mountscript | 60 |
1 files changed, 34 insertions, 26 deletions
diff --git a/data/ad/mountscript b/data/ad/mountscript index 4fa5f36..4812b1e 100644 --- a/data/ad/mountscript +++ b/data/ad/mountscript @@ -4,50 +4,58 @@ # and is not stand-alone! # +VOLUME= +REAL_ACCOUNT= if ! grep -q "^${PAM_USER}:" "/etc/passwd"; then - - if [ -z "$VOLUME" -o -z "$REAL_ACCOUNT" ]; then - # determine fileserver and share for home directories - touch "/tmp/ldapsearch.${PAM_USER}" - chmod 0600 "/tmp/ldapsearch.${PAM_USER}" - ldapsearch -x -LLL uid="${PAM_USER}" homeMount realAccount > "/tmp/ldapsearch.${PAM_USER}" 2>/dev/null || \ - { slxlog "pam-ad-ldapquery" "Could not query LDAP server for parameters of user '${PAM_USER}'."; exit 1; } - VOLUME=$(cat "/tmp/ldapsearch.${PAM_USER}" | grep ^homeMount | head -n 1 | cut -d" " -f2) - [ -z "${VOLUME}" ] && slxlog "pam-ad-ldapvolume" "LDAP server did not provide 'homeMount'. Aborting mount for ${PAM_USER}." && exit 1 - [ -z "$REAL_ACCOUNT" ] && REAL_ACCOUNT=$(cat "/tmp/ldapsearch.${PAM_USER}" | grep ^realAccount | head -n 1 | cut -d" " -f2) - [ -z "$REAL_ACCOUNT" ] && REAL_ACCOUNT="$PAM_USER" + # determine fileserver and share for home directories + BINDDN=$(ldapsearch -l 3 -o nettimeout=3 -o ldif-wrap=no -x -LLL uid="${PAM_USER}" dn distinguishedName | grep -E '^(dn|distinguishedName):' | head -n 1 | cut -d ' ' -f 2) + if [ -z "$BINDDN" ]; then + slxlog "pam-ad-ldapquery" "Could not query DN of user ${PAM_USER}. No home directory available" + else + RESULT=$(mktemp) + PW="/tmp/pw.${RANDOM}.${RANDOM}.${PAM_USER}.${RANDOM}" + mkfifo -m 0600 "${PW}" || slxlog "pam-ad-fifo" "Could not create FIFO at ${PW}" + ( echo "${PAM_AUTHTOK}" > "${PW}" ) & + ldapsearch -y "${PW}" -D "$BINDDN" -l 5 -o nettimeout=5 -o ldif-wrap=no -x -LLL uid="${PAM_USER}" homeMount realAccount > "${RESULT}" 2>/dev/null \ + || slxlog "pam-ad-ldapquery" "Could not query LDAP-AD-Proxy for parameters of user '${PAM_USER}'." + rm -f -- "${PW}" + VOLUME=$(cat "${RESULT}" | grep '^homeMount:' | head -n 1 | cut -d ' ' -f 2) + [ -z "${VOLUME}" ] && slxlog "pam-ad-ldapvolume" "AD/Proxy did not provide 'homeMount'. Aborting mount for ${PAM_USER}." + [ -z "$REAL_ACCOUNT" ] && REAL_ACCOUNT=$(cat "${RESULT}" | grep '^realAccount:' | head -n 1 | cut -d ' ' -f 2) + [ -z "$REAL_ACCOUNT" ] && REAL_ACCOUNT="${PAM_USER}" fi - - MOUNT_OPTS="-v -t cifs -o uid=${USER_UID},gid=${USER_GID},forceuid,forcegid,sec=ntlm" - - SIGNAL=$(mktemp) - rm -f -- "${SIGNAL}" - +fi + +if [ -n "${VOLUME}" ]; then + MOUNT_OPTS="-v -t cifs -o uid=${USER_UID},gid=${USER_GID},forceuid,forcegid,sec=ntlm,nounix,file_mode=0700,dir_mode=0700" + SIGNAL="/tmp/signal.${RANDOM}.${RANDOM}.${PAM_USER}.${RANDOM}" + export USER="${REAL_ACCOUNT}" export PASSWD="${PAM_AUTHTOK}" - - ( mount ${MOUNT_OPTS} "${VOLUME}" "${PERSISTENT_HOME_DIR}" > "/tmp/home.$PAM_USER" 2>&1 || touch "${SIGNAL}" ) & + + ( mount ${MOUNT_OPTS} "${VOLUME}" "${PERSISTENT_HOME_DIR}" > "${RESULT}" 2>&1 || touch "${SIGNAL}" ) & MOUNT_PID=$! for COUNTER in 1 2 4 4; do kill -0 "${MOUNT_PID}" 2>/dev/null || break sleep "${COUNTER}" done - + if [ -e "${SIGNAL}" ]; then - slxlog "pam-ad-mount" "Mount of '${VOLUME}' to '${PERSISTENT_HOME_DIR}' failed. (Args: ${MOUNT_OPTS})" "/tmp/home.$PAM_USER" + slxlog "pam-ad-mount" "Mount of '${VOLUME}' to '${PERSISTENT_HOME_DIR}' failed. (Args: ${MOUNT_OPTS})" "${RESULT}" sleep 1 rm -f -- "${SIGNAL}" elif kill -9 "${MOUNT_PID}" 2>/dev/null; then - slxlog "pam-ad-mount" "Mount of '${VOLUME}' to '${PERSISTENT_HOME_DIR}' timed out. (Args: ${MOUNT_OPTS})" "/tmp/home.$PAM_USER" + slxlog "pam-ad-mount" "Mount of '${VOLUME}' to '${PERSISTENT_HOME_DIR}' timed out. (Args: ${MOUNT_OPTS})" "${RESULT}" sleep 1 else PERSISTENT_OK=yes - chmod -R u+rw "${PERSISTENT_HOME_DIR}" 2>/dev/null + chmod -R u+rwX "${PERSISTENT_HOME_DIR}" 2>/dev/null fi - + unset USER unset PASSWD - - rm -f -- "/tmp/home.$PAM_USER" fi +[ -n "${RESULT}" ] && rm -f -- "${RESULT}" +true + |