summaryrefslogtreecommitdiffstats
path: root/data/ad/mountscript
blob: 4812b1eda6962326ce5d44c90fb373c949285f42 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
###################################################################
#
#       This script is a part of the pam_script_ses_open script
#       and is not stand-alone!
#

VOLUME=
REAL_ACCOUNT=
if ! grep -q "^${PAM_USER}:" "/etc/passwd"; then
	# determine fileserver and share for home directories
	BINDDN=$(ldapsearch -l 3 -o nettimeout=3 -o ldif-wrap=no -x -LLL uid="${PAM_USER}" dn distinguishedName | grep -E '^(dn|distinguishedName):' | head -n 1 | cut -d ' ' -f 2)
	if [ -z "$BINDDN" ]; then
		slxlog "pam-ad-ldapquery" "Could not query DN of user ${PAM_USER}. No home directory available"
	else
		RESULT=$(mktemp)
		PW="/tmp/pw.${RANDOM}.${RANDOM}.${PAM_USER}.${RANDOM}"
		mkfifo -m 0600 "${PW}" || slxlog "pam-ad-fifo" "Could not create FIFO at ${PW}"
		( echo "${PAM_AUTHTOK}" > "${PW}" ) &
		ldapsearch -y "${PW}" -D "$BINDDN" -l 5 -o nettimeout=5 -o ldif-wrap=no -x -LLL uid="${PAM_USER}" homeMount realAccount > "${RESULT}" 2>/dev/null \
			|| slxlog "pam-ad-ldapquery" "Could not query LDAP-AD-Proxy for parameters of user '${PAM_USER}'."
		rm -f -- "${PW}"
		VOLUME=$(cat "${RESULT}" | grep '^homeMount:' | head -n 1 | cut -d ' ' -f 2)
		[ -z "${VOLUME}" ] && slxlog "pam-ad-ldapvolume" "AD/Proxy did not provide 'homeMount'. Aborting mount for ${PAM_USER}."
		[ -z "$REAL_ACCOUNT" ] && REAL_ACCOUNT=$(cat "${RESULT}" | grep '^realAccount:' | head -n 1 | cut -d ' ' -f 2)
		[ -z "$REAL_ACCOUNT" ] && REAL_ACCOUNT="${PAM_USER}"
	fi
fi

if [ -n "${VOLUME}" ]; then
	MOUNT_OPTS="-v -t cifs -o uid=${USER_UID},gid=${USER_GID},forceuid,forcegid,sec=ntlm,nounix,file_mode=0700,dir_mode=0700"
	SIGNAL="/tmp/signal.${RANDOM}.${RANDOM}.${PAM_USER}.${RANDOM}"

	export USER="${REAL_ACCOUNT}"
	export PASSWD="${PAM_AUTHTOK}"

	( mount ${MOUNT_OPTS} "${VOLUME}" "${PERSISTENT_HOME_DIR}" > "${RESULT}" 2>&1 || touch "${SIGNAL}" ) &
	MOUNT_PID=$!
	for COUNTER in 1 2 4 4; do
		kill -0 "${MOUNT_PID}" 2>/dev/null || break
		sleep "${COUNTER}"
	done

	if [ -e "${SIGNAL}" ]; then
		slxlog "pam-ad-mount" "Mount of '${VOLUME}' to '${PERSISTENT_HOME_DIR}' failed. (Args: ${MOUNT_OPTS})" "${RESULT}"
		sleep 1
		rm -f -- "${SIGNAL}"
	elif kill -9 "${MOUNT_PID}" 2>/dev/null; then
		slxlog "pam-ad-mount" "Mount of '${VOLUME}' to '${PERSISTENT_HOME_DIR}' timed out. (Args: ${MOUNT_OPTS})" "${RESULT}"
		sleep 1
	else
		PERSISTENT_OK=yes
		chmod -R u+rwX "${PERSISTENT_HOME_DIR}" 2>/dev/null
	fi

	unset USER
	unset PASSWD
fi

[ -n "${RESULT}" ] && rm -f -- "${RESULT}"
true