diff options
Diffstat (limited to 'data/ad/mountscript')
| -rw-r--r-- | data/ad/mountscript | 131 |
1 files changed, 0 insertions, 131 deletions
diff --git a/data/ad/mountscript b/data/ad/mountscript deleted file mode 100644 index 810eed6..0000000 --- a/data/ad/mountscript +++ /dev/null @@ -1,131 +0,0 @@ -################################################################### -# -# This script is a part of the pam_script_ses_open script -# and is not stand-alone! -# - -VOLUME= -SEARCH= -RESULT= -REAL_ACCOUNT= -WAIT= -TMPDEL= -LOGFILES= -if ! grep -q "^${PAM_USER}:" "/etc/passwd"; then - if which gawk &>/dev/null; then - un64() { - gawk 'BEGIN{FS=":: "}{c="base64 -d";if(/^\w+:: /) {print $2 |& c; close(c,"to"); c |& getline $2; close(c); printf("%s: %s\n", $1, $2); next} print $0 }' - } - else - un64() { - cat - } - fi - # determine fileserver and share for home directories - SEARCH=$(mktemp) - TMPDEL="$TMPDEL $SEARCH" - ldapsearch -l 3 -o nettimeout=3 -o ldif-wrap=no -x -LLL uid="${PAM_USER}" dn distinguishedName homeMount realAccount > "${SEARCH}" 2>&1 - BINDDN=$(cat "${SEARCH}" | grep -E '^(dn|distinguishedName):' | un64 | head -n 1 | cut -d ' ' -f 2-) - if [ -z "$BINDDN" ]; then - slxlog "pam-ad-ldapquery" "Could not query DN of user ${PAM_USER}. No home directory available" "${SEARCH}" - WAIT=1 - else - RESULT=$(mktemp) - TMPDEL="$TMPDEL $RESULT" - PW="/tmp/pw.${RANDOM}.${RANDOM}.${PAM_USER}.${RANDOM}" - mkfifo -m 0600 "${PW}" || slxlog "pam-ad-fifo" "Could not create FIFO at ${PW}" - ( - echo -n "${PAM_AUTHTOK}" > "${PW}" - ) & - if ! ldapsearch -y "${PW}" -D "$BINDDN" -l 5 -o nettimeout=5 -o ldif-wrap=no -x -LLL uid="${PAM_USER}" homeMount realAccount > "${RESULT}" 2>&1; then - slxlog "pam-ad-ldapquery" "Could not query LDAP-AD-Proxy for parameters of user '${PAM_USER}' (${BINDDN})." "${RESULT}" - WAIT=1 - fi - rm -f -- "${PW}" - VOLUME=$(cat "${RESULT}" | grep '^homeMount:' | head -n 1 | cut -d ' ' -f 2-) - [ -z "$REAL_ACCOUNT" ] && REAL_ACCOUNT=$(cat "${RESULT}" | grep '^realAccount:' | head -n 1 | cut -d ' ' -f 2-) - fi - [ -z "$VOLUME" ] && VOLUME=$(cat "${SEARCH}" | grep '^homeMount:' | head -n 1 | cut -d ' ' -f 2-) - [ -z "$VOLUME" ] && slxlog "pam-ad-ldapvolume" "AD/Proxy did not provide 'homeMount'. Aborting mount for ${PAM_USER}." "${RESULT}" - [ -z "$REAL_ACCOUNT" ] && REAL_ACCOUNT=$(cat "${SEARCH}" | grep '^realAccount:' | head -n 1 | cut -d ' ' -f 2-) - [ -z "$REAL_ACCOUNT" ] && REAL_ACCOUNT="${PAM_USER}" -fi - -if [ -n "${VOLUME}" ]; then - isHomeMounted() { - grep -Fuq " ${PERSISTENT_HOME_DIR} " /proc/mounts - } - # Most servers can work without, but some don't - XDOMAIN= - if [ -s "/opt/openslx/inc/shares" ]; then - . /opt/openslx/inc/shares - XDOMAIN="${SHARE_DOMAIN}" - fi - if [ -z "$XDOMAIN" ]; then - XDOMAIN=$(<"/etc/ldap.conf" grep -m1 -i '^BASE\s.*DC=' | grep -o -E -i 'DC=([^,;]+)' | head -n 1 | cut -c 4-) - fi - if [ -z "$XDOMAIN" ]; then - XDOMAIN=$(<"/etc/sssd/sssd.conf" grep -m1 -i '^ldap_search_base\s*=.*DC=' | grep -o -E -i 'DC=[^,;]+' | head -n 1 | cut -c 4-) - fi - if [ "x$XDOMAIN" = "x#" ]; then - XDOMAIN= - fi - # Remember for hooks in pam_script_auth.d - export PERSISTENT_NETPATH=$(echo "$VOLUME" | tr '/' '\') - - export USER="${REAL_ACCOUNT}" - export PASSWD="${PAM_AUTHTOK}" - - # We try 7 different mount option combinations; launch them in 1 second steps until one of them succeeds - CNT=0 - PIDS= - for opt in "vers=3.0,sec=ntlmssp" "vers=2.1,sec=ntlmssp" "vers=1.0,sec=ntlm" "vers=3.0,sec=ntlmv2" "vers=1.0,sec=ntlmv2" "vers=3.0,sec=ntlm" "vers=2.0,sec=ntlmssp"; do - # Also we try with and without explicit domain argument - for dom in "#" $XDOMAIN; do # No quotes - [ "x$dom" != "x#" ] && opt="${opt},domain=$dom" - CNT=$(( CNT + 1 )) - FILE=$(mktemp) - LOGFILES="$LOGFILES $FILE" - MOUNT_OPTS="-v -t cifs -o uid=${USER_UID},gid=${USER_GID},forceuid,forcegid,${opt},nounix,file_mode=0700,dir_mode=0700,noacl,nobrl" - echo " ****** Trying '$opt'" > "$FILE" - mount ${MOUNT_OPTS} "${VOLUME}" "${PERSISTENT_HOME_DIR}" >> "${FILE}" 2>&1 & - PID=$! - # Wait max. 1 second; remember PID if this mount call seems to be running after we stop waiting - for waits in 1 2 3 4; do - usleep 250000 - if isHomeMounted; then - # A previously invoked mount call might have succeeded while this one is still running; try to stop it right away - kill "$PID" &> /dev/null - break 3 - fi - kill -0 "$PID" || break - done - kill -0 "$PID" && PIDS="$PIDS $PID" # Remember all PIDs - done - done - - if [ -n "$PIDS" ]; then - CNT=0 - while ! isHomeMounted && [ "$CNT" -lt 10 ] && kill -0 $PIDS; do # No quotes - usleep 333000 - CNT=$(( CNT + 1 )) - done - kill -9 $PIDS # Kill any leftovers; No quotes - fi - - if ! isHomeMounted; then - LOG_COMBINED=$(mktemp) - [ -n "$LOGFILES" ] && cat ${LOGFILES} > "$LOG_COMBINED" # No quotes - slxlog --delete "pam-ad-mount" "Mount of '${VOLUME}' to '${PERSISTENT_HOME_DIR}' failed." "${LOG_COMBINED}" - else - PERSISTENT_OK=yes - #chmod -R u+rwX "${PERSISTENT_HOME_DIR}" 2>/dev/null TODO: Still needed? Use '&' maybe? - fi - - unset USER - unset PASSWD -fi - -[ -n "${TMPDEL}${LOGFILES}" ] && rm -f -- ${TMPDEL} ${LOGFILES} # No quotes -true - |