Linux – Running sshfs as user via autofs

autofslinuxsshsshfs

My situation:

There are several servers on my LAN which I do not administer
I access them using SSH for sshfs, shells, and remote X11 apps
I have set ControlMaster auto in my ~/.ssh/config file so I don't experience authentication lag
I use Compression and fast/weak Ciphers since I'm either on a private LAN or using VPN
Wherever possible, I have exported my (passwordless) public RSA key to the servers

I've started using autofs to make my life easier, but autofs wants to run all of its mount commands as root. I can, of course, generate a new RSA keypair as root and export that, and also replicate my own ~/.ssh/config options to the superuser's config file, but I'd rather not maintain two copies of these things, and it doesn't solve my desire to have only one open SSH connection to each host. Therefore, I want to have autofs run sshfs as an unprivileged user, just like it does when manually invoked at the terminal.

I've looked into autofs scripts, but those don't appear to be a solution to my problem. Any suggestions?

Best Answer

JFTR, I've modified (and simplified) ssh_user so that it first tries to contact the user's ssh-agent:

#!/bin/bash
# Open a ssh connection as a given user, thus using his/hers authentication
# agent and/or config files.
: ${ADDOPTS:="-2Ax"}
: ${LOCAL:="kreator"}
export SSH_AUTH_SOCK=$(find /tmp/ssh-* -type s -user ${LOCAL} -name agent* | tail -1)
declare -a options=( $* )

# Remove unwanted options
for (( i=0,fin=${#options[*]} ; i < fin ; i++ ))
do
    case ${options[$i]} in
            (-a|-oClearAllForwardings=*)    unset options[$i]
                                            ;;
    esac
done

exec /bin/su ${LOCAL} -c "$(which ssh) ${ADDOPTS} ${options[*]}"

Related Solutions

Sshfs with x forwarding

The way around this problem is to use script in place of ssh command.

man pages of sshfs (at least since 2.0 April 2008)

-o ssh_command=CMD
  execute CMD instead of 'ssh'

Like this:

sshfs user@remote: mountpoint -o ssh_command='/path/to/sshcmd -Y -X -C '

And here's sshcmd

#!/bin/bash

# declare array for ssh options
declare -a CLEANED_SSH_OPTS
declare -a ADD_OPTIONS

# add options to be automatically added to the ssh command here.
# example
#ADD_OPTIONS=( '-C' )
# empty default
ADD_OPTIONS=(  )

for OPT in "$@"; do 
  # add list of values to be removed
  # from sshfs ssh options
  case $OPT in
    "-x")
     # this and these like this will be removed
    ;;
    "-a")
    ;;
    "-oClearAllForwardings=yes")
    ;;
    *)
      # These are ok.. add
      NUM=${#CLEANED_SSH_OPTS[@]}
      CLEANED_SSH_OPTS[$NUM]="$OPT"
    ;;
  esac
done

# Start ssh with CLEANED options
exec ssh ${ADD_OPTIONS[@]} ${CLEANED_SSH_OPTS[@]}
# replace above exec with the next one if you ssh tunneling to run as your 
# local user. Like when using automatic mounts from fstab.
# Please note that this has some extra security issues.
#exec su YourUserName -c "ssh ${ADD_OPTIONS[@]} ${CLEANED_SSH_OPTS[@]}"

Adding something like this to fstab should allow automatic mounting of sshfs and enable forwarding. Do note that when mount happens it's usually root user so you might have to make appropriate changes to sshcmd (see last line of sshcmd).

sshfs#USERID@HOST:/TARGETPATH /MOUNT_POINT fuse _netdev,user,ssh_command=/path/to/sshcmd\040-Y\040-X 0 0

Auto mounting sshfs using autofs fails

Short:

Check that your sshfs command works with root user.

Longer:

Check that root user has ssh identity keys setup. Mounting of sshfs through autofs uses root user for the actual mount.

This is still meant only for desktop or laptop users with a single user using these mounts!

auto.master line

note! use your own uid and gid and specify your prefered mount point I use /auto/mehtod/address

/auto/sshfs /etc/auto.sshfs uid=1000,gid=1000,--timeout=60,--ghost

auto.sshfs this is a bit more generic than just one mount

#!/bin/bash

# Shell script that acccepts one argument, namely userid@server
# env >> /tmp/env_check
# whoami >> /tmp/env_check

key=$1
USER='your_local_user_used_for_ssh_identity_file'
REMOTEDEFAULT='default_to_this_user_otherwise_root'
key=${key//[: #]/}

# add user
[[ ! "$key" =~ "@" ]] && key="${REMOTEDEFAULT}@${key}"

case $key in
   ${REMOTEDEFAULT}@.Trash*)
      exit 1;;
   *)
      (
      echo "-fstype=fuse,idmap=user,rw,nodev,nonempty,transform_symlinks,noatime,allow_other,IdentityFile=/home/${USER}/.ssh/id_dsa,max_read=65536\\"
      echo -e "\t /uhome :sshfs\#$key\:\\"
      echo -e "\t /tmp :sshfs\#$key\:\/tmp\/\\"
      echo -e "\t /rootfs :sshfs\#$key\:\/")
esac

## this is a bit more complex. It creates subfolders to autofs-mount/remotename
## /uhome  = your remote homedirectory
## /rootfs = remote root '/'
## /tmp    = remote tmp # same as /roots/tmp

then link to folder you want to access ln -s /auto/sshfs/userid@my.remote.example.com/uhome/ remote-home