1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
|
###################################################################
#
# This script is a part of the pam_script_ses_open script
# and is not stand-alone!
#
VOLUME=
SEARCH=
RESULT=
REAL_ACCOUNT=
WAIT=
TMPDEL=
if ! grep -q "^${PAM_USER}:" "/etc/passwd"; then
if which gawk &>/dev/null; then
un64() {
gawk 'BEGIN{FS=":: "}{c="base64 -d";if(/^\w+:: /) {print $2 |& c; close(c,"to"); c |& getline $2; close(c); printf("%s: %s\n", $1, $2); next} print $0 }'
}
else
un64() {
cat
}
fi
# determine fileserver and share for home directories
SEARCH=$(mktemp)
TMPDEL="$TMPDEL $SEARCH"
ldapsearch -l 3 -o nettimeout=3 -o ldif-wrap=no -x -LLL uid="${PAM_USER}" dn distinguishedName homeMount realAccount > "${SEARCH}" 2>&1
BINDDN=$(cat "${SEARCH}" | grep -E '^(dn|distinguishedName):' | un64 | head -n 1 | cut -d ' ' -f 2-)
if [ -z "$BINDDN" ]; then
slxlog "pam-ad-ldapquery" "Could not query DN of user ${PAM_USER}. No home directory available" "${SEARCH}"
WAIT=1
else
RESULT=$(mktemp)
TMPDEL="$TMPDEL $RESULT"
PW="/tmp/pw.${RANDOM}.${RANDOM}.${PAM_USER}.${RANDOM}"
mkfifo -m 0600 "${PW}" || slxlog "pam-ad-fifo" "Could not create FIFO at ${PW}"
(
echo -n "${PAM_AUTHTOK}" > "${PW}"
) &
if ! ldapsearch -y "${PW}" -D "$BINDDN" -l 5 -o nettimeout=5 -o ldif-wrap=no -x -LLL uid="${PAM_USER}" homeMount realAccount > "${RESULT}" 2>&1; then
slxlog "pam-ad-ldapquery" "Could not query LDAP-AD-Proxy for parameters of user '${PAM_USER}' (${BINDDN})." "${RESULT}"
WAIT=1
fi
rm -f -- "${PW}"
VOLUME=$(cat "${RESULT}" | grep '^homeMount:' | head -n 1 | cut -d ' ' -f 2-)
[ -z "$REAL_ACCOUNT" ] && REAL_ACCOUNT=$(cat "${RESULT}" | grep '^realAccount:' | head -n 1 | cut -d ' ' -f 2)
fi
[ -z "$VOLUME" ] && VOLUME=$(cat "${SEARCH}" | grep '^homeMount:' | head -n 1 | cut -d ' ' -f 2-)
[ -z "$VOLUME" ] && slxlog "pam-ad-ldapvolume" "AD/Proxy did not provide 'homeMount'. Aborting mount for ${PAM_USER}." "${RESULT}"
[ -z "$REAL_ACCOUNT" ] && REAL_ACCOUNT=$(cat "${SEARCH}" | grep '^realAccount:' | head -n 1 | cut -d ' ' -f 2)
[ -z "$REAL_ACCOUNT" ] && REAL_ACCOUNT="${PAM_USER}"
fi
if [ -n "${VOLUME}" ]; then
isHomeMounted() {
grep -Fuq " ${PERSISTENT_HOME_DIR} " /proc/mounts
}
# Remember for hooks in pam_script_auth.d
export PERSISTENT_NETPATH=$(echo "$VOLUME" | tr '/' '\')
export USER="${REAL_ACCOUNT}"
export PASSWD="${PAM_AUTHTOK}"
# We try 7 different mount option combinations; launch them in 1 second steps until one of them succeeds
CNT=0
PIDS=
for opt in "vers=3.0,sec=ntlmssp" "vers=2.1,sec=ntlmssp" "vers=1.0,sec=ntlm" "vers=3.0,sec=ntlmv2" "vers=1.0,sec=ntlmv2" "vers=3.0,sec=ntlm" "vers=2.0,sec=ntlmssp"; do
CNT=$(( CNT + 1 ))
FILEVAR="LOG$CNT"
FILE=$(mktemp)
eval "${FILEVAR}=$FILE"
TMPDEL="$TMPDEL $FILE"
MOUNT_OPTS="-v -t cifs -o uid=${USER_UID},gid=${USER_GID},forceuid,forcegid,${opt},nounix,file_mode=0700,dir_mode=0700,noacl,nobrl"
echo " * Trying '$opt'" > "$FILE"
mount ${MOUNT_OPTS} "${VOLUME}" "${PERSISTENT_HOME_DIR}" >> "${FILE}" 2>&1 &
PID=$!
PIDS="$PIDS $PID" # Remember all PIDs
usleep 250000
kill -0 "$PID" && usleep 250000
kill -0 "$PID" && usleep 250000
kill -0 "$PID" && usleep 250000
isHomeMounted && break
done
while ! isHomeMounted && [ "$CNT" -lt 10 ] && kill -0 $PIDS; do # No quotes
sleep 1
CNT=$(( CNT + 1 ))
done
kill -9 $PIDS # Kill any leftovers; No quotes
if ! isHomeMounted; then
LOG_COMBINED=$(mktemp)
cat "$LOG1" "$LOG2" "$LOG3" "$LOG4" "$LOG5" "$LOG6" > "$LOG_COMBINED"
slxlog --delete "pam-ad-mount" "Mount of '${VOLUME}' to '${PERSISTENT_HOME_DIR}' failed." "${LOG_COMBINED}"
else
PERSISTENT_OK=yes
#chmod -R u+rwX "${PERSISTENT_HOME_DIR}" 2>/dev/null TODO: Still needed? Use & maybe?
fi
unset USER
unset PASSWD
fi
[ -n "${TMPDEL}" ] && rm -f -- ${TMPDEL} # No quotes
true
|
