Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

I successfully installed and configured krb5 on a Red Hat 6.4 server, now I can authenticate against an active directory with kerberos.

pam_mount is installed and configured, but it only mounts a cifs share, if I first enter the command

kinit username

on the host before logging in. Then I make a kdestroy and try it again, but it doesn't mount the share anymore.

So my conclusion is, that there is no kerberos ticket for pam_mount. But why, if I can login with my kerberos account?

this is my pam_mount.conf.xml:

<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">

<volume fstype="cifs" ssh="0" server="" 
path="A_21_Home11$/%(USER)" mountpoint="~" options="sec=krb5" user="*" />

<logout wait="0" hup="0" term="0" kill="0" />

<mkmountpoint enable="1" remove="true" />


This is my /etc/pam.d/system-auth:

auth        required
auth        sufficient nullok try_first_pass
auth        requisite uid >= 500 quiet
auth        sufficient use_first_pass
auth        required
auth        required

account     required broken_shadow
account     sufficient uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore]
account     required

password    requisite retry=3 type=
password    sufficient shadow nullok try_first_pass use_authtok
password    sufficient use_authtok
password    required

session     optional revoke
session     required
session     [success=1 default=ignore] service in crond quiet use_uid
session     required
session     optional use_authtok
session     optional
share|improve this question

closed as off-topic by Mark, Xander, AJ Henderson, Gilles, Rоry McCune Oct 14 '14 at 14:53

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

How are you logging in? –  chuck May 16 '13 at 15:45
What does klist -f show you at various points in this process? I'm guessing that you aren't getting forwardable tickets at some point. You can test this with kinit -f . Check the pam section of appdefaults in krb5.conf. Setting forwardable=true and external=sshd may help. –  chuck May 16 '13 at 15:52
This question appears to be off-topic because it would be a better fit for –  Mark Oct 14 '14 at 0:42

Browse other questions tagged or ask your own question.