3

When a Linux machine joins a domain, a computer account is created in Active Directory.

Can this account be used to mount a network share with cifs and Kerberos?

Improve this question
5
  • First, you'll need to setup Kerberos SSO using a keytab file. Once that's in place, follow the scenario here which matches your use case: centrify.force.com/support/Article/….
    – T-Heron
    Commented Jun 7, 2021 at 1:03
  • @T-Heron Are you sure it can work with a machine account only? When I run klist I see my user's ticket, not the machine's.
    – bbigras
    Commented Jun 9, 2021 at 19:03
  • klist -li 0x3e7 ---> will give you a list of the system account’s tickets
    – T-Heron
    Commented Jun 9, 2021 at 23:39
  • @T-Heron I only see my user in the list (in the Principal name column).
    – bbigras
    Commented Jun 11, 2021 at 14:10
  • 1
    That's because klist -li does a completely different thing in Windows; using klist -li 0x3e7 on Linux is outright meaningless.
    – grawity_u1686
    Commented Jun 18, 2021 at 20:00

1 Answer 1

Reset to default
0

Make sure root (uid 0) has a Kerberos ticket cache for the machine account – the tickets can be acquired using the system keytab, e.g. with kinit -k. However, to automatically maintain and renew them, you might need to run kstart as a system daemon. (It is not enough to just call kinit on startup, as valid tickets will be necessary whenever the connection is lost and re-established, e.g. if the SMB server gets rebooted.)

[Service]
Type=forking
ExecStart=/usr/bin/k5start -f /etc/krb5.keytab -U -k /tmp/krb5cc_0 -o root -b -K 60 -v -L

Oh, and make sure that the system actually has a Kerberos keytab for its machine account. (Use klist -k to check the keytab's contents.) SSSD/adcli joins will always have one at /etc/krb5.keytab, but joining using Samba might not generate one by default.

Once root has a ticket cache, you should be able to just mount SMB with -o sec=krb5,multiuser, and as root is performing the mount, its tickets will be used. This should work from /etc/fstab all the same, as long as you ensure that the 'kstart' service does its job earlier than the SMB mounts are attempted, e.g. by using the fstab option x-systemd.requires=kstart.service.

Improve this answer
1
  • Note that, individual users still need to provide vaild kerberos to access the share. If you want the users/scripts can run without providing tickets themselves, delegation and impersonate are required.
    – Ding-Yi Chen
    Commented Nov 16, 2023 at 6:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .