41161 2021-10-19 09:38:50 +0300 При входе не (авто)монтируется сетевая папка на сервере AD 2021-10-20 10:50:35 +0300 1 1 1 Unclassified Branch p10 pam_mount не указана x86_64 Linux CLOSED WORKSFORME https://bugzilla.altlinux.org/show_bug.cgi?id=40887 P5 normal --- 1 vercha qa-team greh iv sin svn17 qa-p10 oldest_to_newest 203947 0 9843 vercha 2021-10-19 09:38:50 +0300 Created attachment 9843 logs.txt Конфигурация стендов: Настроено доверие между FreeIPA на p10 Alt Server x86_64 и AD на Windows server. Клиент FreeIPA - p10 Alt Workstation x86_64 pam_mount-2.18-alt1.x86_64 cifs-utils-6.13-alt3.x86_64 1) На сервере AD создана папка, включен общий доступ, права на чтение и запись. На FreeIPA клиенте в диспетчере файлов ввести адрес вида: smb://server/share = ОК 2) Примонтировать общую папку: # mkdir -p /mnt/adshare && mount -v -t cifs -o user=aduser //10.88.8.226/share /mnt/adshare && l /mnt/adshare Проверить создание/редактирование/удаление файлов = ОК 3) Настроить pam_mount и проверить автомонтирование при логине. # cat /etc/security/pam_mount.conf.xml <?xml version="1.0" encoding="utf-8" ?> <!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd"> <pam_mount> <debug enable="1" /> <volume uid="10000-2000200000" fstype="cifs" server="10.88.8.226" path="share" mountpoint="~/share" options="vers=2.0,cruid=%(USERUID),nounix,uid=%(USERUID),gid=%(USERGID),file_mode=0664,dir_mode=0775,user=%(DOMAIN_USER)" /> <cifsmount>/sbin/mount.cifs //%(SERVER)/%(VOLUME) %(MNTPT) -o %(OPTIONS)</cifsmount> <cifsumount>/sbin/umount %(MNTPT)</cifsumount> <mntoptions allow="nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other,sec" /> <mntoptions require="nosuid,nodev" /> <logout wait="0" hup="no" term="no" kill="no" /> <mkmountpoint enable="1" remove="true" /> </pam_mount> # cat /etc/pam.d/system-auth-sss | grep pam_mount auth optional pam_mount.so session optional pam_mount.so 4) Перезагрузить систему и авторизоваться на клиенте пользователем из домена AD. Результат: после входа в систему НЕ создалась папка share. Если зайти на smb://server/share, то папка появляется, но до следующего входа. Ожидаемый результат: В домашней директории создана папка share. Файлы доступны для создания/редактирования/удаления. Дополнительно: Результат выполнения команды klist после входа: $ klist Ticket cache: KEYRING:persistent:1084801107:krb_ccache_k4PBNFy Default principal: aduser1@ALTAD.TESTDOMA Valid starting Expires Service principal 19.10.2021 09:24:56 19.10.2021 19:24:53 krbtgt/FREEIPA.TESTDOMAIN@ALTAD.TESTDOMA renew until 20.10.2021 09:24:53 19.10.2021 09:24:53 19.10.2021 19:24:53 krbtgt/ALTAD.TESTDOMA@ALTAD.TESTDOMA renew until 20.10.2021 09:24:53 203951 1 vercha 2021-10-19 10:38:05 +0300 Доп. исследование: если привести строчку в pam_mount.conf.xml к виду <volume uid="10000-2000200000" fstype="cifs" server="10.88.8.226" path="share" mountpoint="~/share" options="vers=2.0,cruid=%(USERUID),nounix,uid=%(USERUID),gid=%(USERGID),file_mode=0664,dir_mode=0775,user=%(USER)" /> То шара монтируется нормально. Убрала из options параметр sec=krb5 и изменила user=%(USER) 203992 2 sin 2021-10-20 04:41:08 +0300 Странное поведение... Хотя возникает вопрос: - у нас, вроде, kerberos; - а почему указан ip-адрес узла, а не его доменное имя? - редко, в каких сетях настроена обратная зона, да и в этом случае могут быть коллизии. 203993 3 sin 2021-10-20 04:53:15 +0300 Обращаю внимание на этот коммит: https://github.com/samba-team/samba/commit/e25a9e8f4ec8034d2974a887e4f64e99a04f226a Removed SMB (development) dialects ---------------------------------- The following SMB (development) dialects are no longer supported: SMB2_22, SMB2_24 and SMB3_10. They are were only supported by Windows technical preview builds. They used to be useful in order to test against the latest Windows versions, but it's no longer useful to have them. If you have them explicitly specified in your smb.conf or an the command line, you need to replace them like this: - SMB2_22 => SMB3_00 - SMB2_24 => SMB3_00 - SMB3_10 => SMB3_11 Note that it's typically not useful to specify "client max protocol" or "server max protocol" explicitly to a specific dialect, just leave them unspecified or specify the value "default". ____________________________________ В связи с этим хочу уточнить на каком основании была выбрана и явно указан версия протокола vers=2.0? ____________________________________ В man mount.cifs по этому поводу явно указано: vers=arg SMB protocol version. Allowed values are: · 1.0 - The classic CIFS/SMBv1 protocol. · 2.0 - The SMBv2.002 protocol. This was initially introduced in Windows Vista Service Pack 1, and Windows Server 2008. Note that the initial release version of Windows Vista spoke a slightly different dialect (2.000) that is not supported. · 2.1 - The SMBv2.1 protocol that was introduced in Microsoft Windows 7 and Windows Server 2008R2. · 3.0 - The SMBv3.0 protocol that was introduced in Microsoft Windows 8 and Windows Server 2012. · 3.02 or 3.0.2 - The SMBv3.0.2 protocol that was introduced in Microsoft Windows 8.1 and Windows Server 2012R2. · 3.1.1 or 3.11 - The SMBv3.1.1 protocol that was introduced in Microsoft Windows 10 and Windows Server 2016. · 3 - The SMBv3.0 protocol version and above. · default - Tries to negotiate the highest SMB2+ version supported by both the client and server. If no dialect is specified on mount vers=default is used. To check Dialect refer to /proc/fs/cifs/DebugData Note too that while this option governs the protocol version used, not all features of each version are available. The default since v4.13.5 is for the client and server to negotiate the highest possible version greater than or equal to 2.1. In kernels prior to v4.13, the default was 1.0. For kernels between v4.13 and v4.13.5 the default is 3.0. 203994 4 sin 2021-10-20 04:59:36 +0300 Насколько видно из лога: окт 19 09:24:56 client-uwsry.freeipa.testdomain cifs.upcall[3857]: get_cachename_from_process_env: pathname=/proc/3854/environ окт 19 09:24:56 client-uwsry.freeipa.testdomain cifs.upcall[3857]: get_existing_cc: default ccache is KEYRING:persistent:1084801107:krb_ccache_k4PBNFy окт 19 09:24:56 client-uwsry.freeipa.testdomain cifs.upcall[3857]: handle_krb5_mech: getting service ticket for 10.88.8.226 окт 19 09:24:56 client-uwsry.freeipa.testdomain cifs.upcall[3857]: cifs_krb5_get_req: unable to get credentials for 10.88.8.226 окт 19 09:24:56 client-uwsry.freeipa.testdomain cifs.upcall[3857]: handle_krb5_mech: failed to obtain service ticket (-1765328377) окт 19 09:24:56 client-uwsry.freeipa.testdomain cifs.upcall[3857]: Unable to obtain service ticket окт 19 09:24:56 client-uwsry.freeipa.testdomain cifs.upcall[3857]: Exit status -1765328377 Билет для службы на узле 10.88.8.226 не был найден. Так он и не может быть найден по ip-адресу. Указывать следует доменное имя узла. 203999 5 vercha 2021-10-20 10:50:20 +0300 Закрываю данный issue как worksforme Workaround описан в https://bugzilla.altlinux.org/show_bug.cgi?id=41161#c1 Работает и с доменным именем, и с ip. 9843 2021-10-19 09:38:50 +0300 2021-10-19 09:38:50 +0300 logs.txt logs.txt text/plain 5182 vercha IArQvtC60YIgMTkgMDk6MjQ6NTYgY2xpZW50LXV3c3J5LmZyZWVpcGEudGVzdGRvbWFpbiBrZXJu ZWw6IGF1ZGl0OiB0eXBlPTExMDEgYXVkaXQoMTYzNDYyNDY5Ni4yNjk6MTU2KTogcGlkPTM4NTMg dWlkPTAgYXVpZD00Mjk0OTY3Mjk1IHNlcz00Mjk0OTY3Mjk1IG1zZz0nb3A9UEFNOmFjY291bnRp bmcgZ3JhbnRvcnM9cGFtX3NzcyBhY2N0PSJhZHVzZXIxQGFsdGFkLnRlc3Rkb21hIiBleGU9Ii9s aWIvc3lzdGVtZC9zeXN0ZW1kIiBob3N0bmFtZT0/IGFkZHI9PyB0ZXJtaW5hbD0/IHJlcz1zdWNj ZXNzJwrQvtC60YIgMTkgMDk6MjQ6NTYgY2xpZW50LXV3c3J5LmZyZWVpcGEudGVzdGRvbWFpbiBz eXN0ZW1kWzM4NTNdOiAocGFtX21vdW50LmM6MTczKTogY29udi0+Y29udiguLi4pOiBDb252ZXJz YXRpb24gZXJyb3IK0L7QutGCIDE5IDA5OjI0OjU2IGNsaWVudC11d3NyeS5mcmVlaXBhLnRlc3Rk b21haW4gc3lzdGVtZFszODUzXTogKHBhbV9tb3VudC5jOjQ3Nik6IHdhcm5pbmc6IGNvdWxkIG5v dCBvYnRhaW4gcGFzc3dvcmQgaW50ZXJhY3RpdmVseSBlaXRoZXIK0L7QutGCIDE5IDA5OjI0OjU2 IGNsaWVudC11d3NyeS5mcmVlaXBhLnRlc3Rkb21haW4gc3lzdGVtZFszODUzXTogKHBhbV9tb3Vu dC5jOjE3Myk6IGNvbnYtPmNvbnYoLi4uKTogQ29udmVyc2F0aW9uIGVycm9yCtC+0LrRgiAxOSAw OToyNDo1NiBjbGllbnQtdXdzcnkuZnJlZWlwYS50ZXN0ZG9tYWluIHN5c3RlbWRbMzg1M106IChw YW1fbW91bnQuYzo0NzYpOiB3YXJuaW5nOiBjb3VsZCBub3Qgb2J0YWluIHBhc3N3b3JkIGludGVy YWN0aXZlbHkgZWl0aGVyCtC+0LrRgiAxOSAwOToyNDo1NiBjbGllbnQtdXdzcnkuZnJlZWlwYS50 ZXN0ZG9tYWluIGtlcm5lbDogQ0lGUzogQXR0ZW1wdGluZyB0byBtb3VudCBcXDEwLjg4LjguMjI2 XHNoYXJlCtC+0LrRgiAxOSAwOToyNDo1NiBjbGllbnQtdXdzcnkuZnJlZWlwYS50ZXN0ZG9tYWlu IGNpZnMudXBjYWxsWzM4NTddOiBrZXkgZGVzY3JpcHRpb246IGNpZnMuc3BuZWdvOzA7MDszOTAx MDAwMDt2ZXI9MHgyO2hvc3Q9MTAuODguOC4yMjY7aXA0PTEwLjg4LjguMjI2O3NlYz1rcmI1O3Vp ZD0weDQwYThjMDUzO2NyZWR1aWQ9MHg0MGE4YzA1Mzt1c2VyPXJvb3Q7cGlkPTB4ZjBlICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAK0L7QutGCIDE5IDA5OjI0 OjU2IGNsaWVudC11d3NyeS5mcmVlaXBhLnRlc3Rkb21haW4gY2lmcy51cGNhbGxbMzg1OF06IHZl cj0yCtC+0LrRgiAxOSAwOToyNDo1NiBjbGllbnQtdXdzcnkuZnJlZWlwYS50ZXN0ZG9tYWluIGNp ZnMudXBjYWxsWzM4NThdOiBob3N0PTEwLjg4LjguMjI2CtC+0LrRgiAxOSAwOToyNDo1NiBjbGll bnQtdXdzcnkuZnJlZWlwYS50ZXN0ZG9tYWluIGNpZnMudXBjYWxsWzM4NThdOiBpcD0xMC44OC44 LjIyNgrQvtC60YIgMTkgMDk6MjQ6NTYgY2xpZW50LXV3c3J5LmZyZWVpcGEudGVzdGRvbWFpbiBj aWZzLnVwY2FsbFszODU4XTogc2VjPTEK0L7QutGCIDE5IDA5OjI0OjU2IGNsaWVudC11d3NyeS5m cmVlaXBhLnRlc3Rkb21haW4gY2lmcy51cGNhbGxbMzg1OF06IHVpZD0xMDg0ODAxMTA3CtC+0LrR giAxOSAwOToyNDo1NiBjbGllbnQtdXdzcnkuZnJlZWlwYS50ZXN0ZG9tYWluIGNpZnMudXBjYWxs WzM4NThdOiBjcmVkdWlkPTEwODQ4MDExMDcK0L7QutGCIDE5IDA5OjI0OjU2IGNsaWVudC11d3Ny eS5mcmVlaXBhLnRlc3Rkb21haW4gY2lmcy51cGNhbGxbMzg1OF06IHVzZXI9cm9vdArQvtC60YIg MTkgMDk6MjQ6NTYgY2xpZW50LXV3c3J5LmZyZWVpcGEudGVzdGRvbWFpbiBjaWZzLnVwY2FsbFsz ODU4XTogcGlkPTM4NTQK0L7QutGCIDE5IDA5OjI0OjU2IGNsaWVudC11d3NyeS5mcmVlaXBhLnRl c3Rkb21haW4gY2lmcy51cGNhbGxbMzg1N106IGdldF9jYWNoZW5hbWVfZnJvbV9wcm9jZXNzX2Vu djogcGF0aG5hbWU9L3Byb2MvMzg1NC9lbnZpcm9uCtC+0LrRgiAxOSAwOToyNDo1NiBjbGllbnQt dXdzcnkuZnJlZWlwYS50ZXN0ZG9tYWluIGNpZnMudXBjYWxsWzM4NTddOiBnZXRfZXhpc3Rpbmdf Y2M6IGRlZmF1bHQgY2NhY2hlIGlzIEtFWVJJTkc6cGVyc2lzdGVudDoxMDg0ODAxMTA3OmtyYl9j Y2FjaGVfazRQQk5GeQrQvtC60YIgMTkgMDk6MjQ6NTYgY2xpZW50LXV3c3J5LmZyZWVpcGEudGVz dGRvbWFpbiBjaWZzLnVwY2FsbFszODU3XTogaGFuZGxlX2tyYjVfbWVjaDogZ2V0dGluZyBzZXJ2 aWNlIHRpY2tldCBmb3IgMTAuODguOC4yMjYK0L7QutGCIDE5IDA5OjI0OjU2IGNsaWVudC11d3Ny eS5mcmVlaXBhLnRlc3Rkb21haW4gY2lmcy51cGNhbGxbMzg1N106IGNpZnNfa3JiNV9nZXRfcmVx OiB1bmFibGUgdG8gZ2V0IGNyZWRlbnRpYWxzIGZvciAxMC44OC44LjIyNgrQvtC60YIgMTkgMDk6 MjQ6NTYgY2xpZW50LXV3c3J5LmZyZWVpcGEudGVzdGRvbWFpbiBjaWZzLnVwY2FsbFszODU3XTog aGFuZGxlX2tyYjVfbWVjaDogZmFpbGVkIHRvIG9idGFpbiBzZXJ2aWNlIHRpY2tldCAoLTE3NjUz MjgzNzcpCtC+0LrRgiAxOSAwOToyNDo1NiBjbGllbnQtdXdzcnkuZnJlZWlwYS50ZXN0ZG9tYWlu IGNpZnMudXBjYWxsWzM4NTddOiBVbmFibGUgdG8gb2J0YWluIHNlcnZpY2UgdGlja2V0CtC+0LrR giAxOSAwOToyNDo1NiBjbGllbnQtdXdzcnkuZnJlZWlwYS50ZXN0ZG9tYWluIGNpZnMudXBjYWxs WzM4NTddOiBFeGl0IHN0YXR1cyAtMTc2NTMyODM3NwrQvtC60YIgMTkgMDk6MjQ6NTYgY2xpZW50 LXV3c3J5LmZyZWVpcGEudGVzdGRvbWFpbiBzeXN0ZW1kWzM4NTNdOiAobW91bnQuYzo2OCk6IE1l c3NhZ2VzIGZyb20gdW5kZXJseWluZyBtb3VudCBwcm9ncmFtOgrQvtC60YIgMTkgMDk6MjQ6NTYg Y2xpZW50LXV3c3J5LmZyZWVpcGEudGVzdGRvbWFpbiBzeXN0ZW1kWzM4NTNdOiAobW91bnQuYzo2 OCk6IE1lc3NhZ2VzIGZyb20gdW5kZXJseWluZyBtb3VudCBwcm9ncmFtOgrQvtC60YIgMTkgMDk6 MjQ6NTYgY2xpZW50LXV3c3J5LmZyZWVpcGEudGVzdGRvbWFpbiBzeXN0ZW1kWzM4NTNdOiAobW91 bnQuYzo3Mik6IG1vdW50IGVycm9yKDEyNik6IFJlcXVpcmVkIGtleSBub3QgYXZhaWxhYmxlCtC+ 0LrRgiAxOSAwOToyNDo1NiBjbGllbnQtdXdzcnkuZnJlZWlwYS50ZXN0ZG9tYWluIHN5c3RlbWRb Mzg1M106IChtb3VudC5jOjcyKTogUmVmZXIgdG8gdGhlIG1vdW50LmNpZnMoOCkgbWFudWFsIHBh Z2UgKGUuZy4gbWFuIG1vdW50LmNpZnMpIGFuZCBrZXJuZWwgbG9nIG1lc3NhZ2VzIChkbWVzZykK 0L7QutGCIDE5IDA5OjI0OjU2IGNsaWVudC11d3NyeS5mcmVlaXBhLnRlc3Rkb21haW4gc3lzdGVt ZFszODUzXTogKHBhbV9tb3VudC5jOjUyMik6IG1vdW50IG9mIHNoYXJlIGZhaWxlZArQvtC60YIg MTkgMDk6MjQ6NTYgY2xpZW50LXV3c3J5LmZyZWVpcGEudGVzdGRvbWFpbiBzeXN0ZW1kWzM4NTNd OiAocGFtX21vdW50LmM6MTczKTogY29udi0+Y29udiguLi4pOiBDb252ZXJzYXRpb24gZXJyb3IK 0L7QutGCIDE5IDA5OjI0OjU2IGNsaWVudC11d3NyeS5mcmVlaXBhLnRlc3Rkb21haW4gc3lzdGVt ZFszODUzXTogKHBhbV9tb3VudC5jOjQ3Nik6IHdhcm5pbmc6IGNvdWxkIG5vdCBvYnRhaW4gcGFz c3dvcmQgaW50ZXJhY3RpdmVseSBlaXRoZXIK0L7QutGCIDE5IDA5OjI0OjU2IGNsaWVudC11d3Ny eS5mcmVlaXBhLnRlc3Rkb21haW4ga2VybmVsOiBDSUZTOiBWRlM6IFZlcmlmeSB1c2VyIGhhcyBh IGtyYjUgdGlja2V0IGFuZCBrZXl1dGlscyBpcyBpbnN0YWxsZWQK0L7QutGCIDE5IDA5OjI0OjU2 IGNsaWVudC11d3NyeS5mcmVlaXBhLnRlc3Rkb21haW4ga2VybmVsOiBDSUZTOiBWRlM6IFxcMTAu ODguOC4yMjYgU2VuZCBlcnJvciBpbiBTZXNzU2V0dXAgPSAtMTI2CtC+0LrRgiAxOSAwOToyNDo1 NiBjbGllbnQtdXdzcnkuZnJlZWlwYS50ZXN0ZG9tYWluIGtlcm5lbDogQ0lGUzogVkZTOiBjaWZz X21vdW50IGZhaWxlZCB3L3JldHVybiBjb2RlID0gLTEyNgrQvtC60YIgMTkgMDk6MjQ6NTYgY2xp ZW50LXV3c3J5LmZyZWVpcGEudGVzdGRvbWFpbiBzeXN0ZW1kWzM4NTNdOiAobW91bnQuYzo3Mik6 IG1vdW50IGVycm9yKDEyNik6IFJlcXVpcmVkIGtleSBub3QgYXZhaWxhYmxlCtC+0LrRgiAxOSAw OToyNDo1NiBjbGllbnQtdXdzcnkuZnJlZWlwYS50ZXN0ZG9tYWluIHN5c3RlbWRbMzg1M106ICht b3VudC5jOjcyKTogUmVmZXIgdG8gdGhlIG1vdW50LmNpZnMoOCkgbWFudWFsIHBhZ2UgKGUuZy4g bWFuIG1vdW50LmNpZnMpIGFuZCBrZXJuZWwgbG9nIG1lc3NhZ2VzIChkbWVzZykK0L7QutGCIDE5 IDA5OjI0OjU2IGNsaWVudC11d3NyeS5mcmVlaXBhLnRlc3Rkb21haW4gc3lzdGVtZFszODUzXTog KHBhbV9tb3VudC5jOjUyMik6IG1vdW50IG9mIHNoYXJlIGZhaWxlZArQvtC60YIgMTkgMDk6MjQ6 NTYgY2xpZW50LXV3c3J5LmZyZWVpcGEudGVzdGRvbWFpbiBzeXN0ZW1kWzM4NTNdOiAocGFtX21v dW50LmM6MTczKTogY29udi0+Y29udiguLi4pOiBDb252ZXJzYXRpb24gZXJyb3IK0L7QutGCIDE5 IDA5OjI0OjU2IGNsaWVudC11d3NyeS5mcmVlaXBhLnRlc3Rkb21haW4gc3lzdGVtZFszODUzXTog KHBhbV9tb3VudC5jOjQ3Nik6IHdhcm5pbmc6IGNvdWxkIG5vdCBvYnRhaW4gcGFzc3dvcmQgaW50 ZXJhY3RpdmVseSBlaXRoZXIK0L7QutGCIDE5IDA5OjI0OjU2IGNsaWVudC11d3NyeS5mcmVlaXBh LnRlc3Rkb21haW4gc3lzdGVtZFszODU5XTogSW52YWxpZCB1c2VyIG5hbWUKCgoKJCBrbGlzdApU aWNrZXQgY2FjaGU6IEtFWVJJTkc6cGVyc2lzdGVudDoxMDg0ODAxMTA3OmtyYl9jY2FjaGVfazRQ Qk5GeQpEZWZhdWx0IHByaW5jaXBhbDogYWR1c2VyMUBBTFRBRC5URVNURE9NQQoKVmFsaWQgc3Rh cnRpbmcgICAgICAgRXhwaXJlcyAgICAgICAgICAgICAgU2VydmljZSBwcmluY2lwYWwKMTkuMTAu MjAyMSAwOToyNDo1NiAgMTkuMTAuMjAyMSAxOToyNDo1MyAga3JidGd0L0ZSRUVJUEEuVEVTVERP TUFJTkBBTFRBRC5URVNURE9NQQoJcmVuZXcgdW50aWwgMjAuMTAuMjAyMSAwOToyNDo1MwoxOS4x MC4yMDIxIDA5OjI0OjUzICAxOS4xMC4yMDIxIDE5OjI0OjUzICBrcmJ0Z3QvQUxUQUQuVEVTVERP TUFAQUxUQUQuVEVTVERPTUEKCXJlbmV3IHVudGlsIDIwLjEwLjIwMjEgMDk6MjQ6NTMKCg==