I successfully installed and configured krb5 on a Red Hat 6.4 server, now I can authenticate against an active directory with kerberos.

pam_mount is installed and configured, but it only mounts a cifs share, if I first enter the command

kinit username

on the host before logging in. Then I make a kdestroy and try it again, but it doesn't mount the share anymore.

So my conclusion is, that there is no kerberos ticket for pam_mount. But why, if I can login with my kerberos account?

this is my pam_mount.conf.xml:

<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">

<volume fstype="cifs" ssh="0" server="fsamu21.adm.ds.domain.ch" 
path="A_21_Home11$/%(USER)" mountpoint="~" options="sec=krb5" user="*" />

<logout wait="0" hup="0" term="0" kill="0" />

<mkmountpoint enable="1" remove="true" />


This is my /etc/pam.d/system-auth:

auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_krb5.so use_first_pass
auth        required      pam_mount.so
auth        required      pam_deny.so

account     required      pam_unix.so broken_shadow
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_krb5.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so retry=3 type=
password    sufficient    pam_unix.so shadow nullok try_first_pass use_authtok
password    sufficient    pam_krb5.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_krb5.so use_authtok
session     optional      pam_mount.so

closed as off-topic by Mark, Xander, AJ Henderson, Gilles, Rоry McCune Oct 14 '14 at 14:53

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • How are you logging in? – chuck May 16 '13 at 15:45
  • What does klist -f show you at various points in this process? I'm guessing that you aren't getting forwardable tickets at some point. You can test this with kinit -f . Check the pam section of appdefaults in krb5.conf. Setting forwardable=true and external=sshd may help. – chuck May 16 '13 at 15:52
  • 3
    This question appears to be off-topic because it would be a better fit for unix.stackexchange.com – Mark Oct 14 '14 at 0:42

Browse other questions tagged or ask your own question.