Ssh – Problem with pam_mount and sshfs

debianpamsshsshfs

I'm trying to configure automounting of users home directories using pam_mount and sshfs (users are LDAP users on remote machine).

I configured pam_mount:

<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">
<pam_mount>
<debug enable="1" />
<mntoptions allow="nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other" />
<mntoptions require="nosuid,nodev" />
<logout wait="0" hup="0" term="0" kill="0" />
<mkmountpoint enable="1" remove="true" />
<volume fstype="fuse" path="sshfs#%(USER)@HOSTNAME:" mountpoint="~" ssh="1" options="reconnect,idmap=user,password_stdin,nonempty" />
</pam_mount>

When I'm trying to su to user I'm asked about password:

root@debian:~# su - pszubert
pam_mount(pam_mount.c:553): pam_mount 2.5: entering session stage
reenter password for pam_mount:
pam_mount(misc.c:38): Session open: (ruid/rgid=0/20001, e=0/20001)
pam_mount(mount.c:213): Mount info: globalconf, user=pszubert <volume fstype="fuse" server="(null)" path="sshfs#pszubert@HOST:" mountpoint="/home/pszubert" cipher="(null)" fskeypath="(null)" fskeycipher="(null)" fskeyhash="(null)" options="reconnect,idmap=user,password_stdin,nonempty" /> fstab=0 ssh=1
command: 'pmt-fd0ssh' 'mount.fuse' 'sshfs#pszubert@HOST:' '/home/pszubert' '-oreconnect,idmap=user,password_stdin,nonempty' 
pam_mount(spawn.c:108): setting uid to user pszubert
pam_mount(misc.c:38): set_myuid<post>: (ruid/rgid=20001/20001, e=20001/20001)
System plików  Typ bl.  1K B        użyte dostępne %uż. zamont. na
/dev/sda1     ext3     7867856    940236   6527956  13% /
tmpfs        tmpfs      192316         0    192316   0% /lib/init/rw
proc          proc           0         0         0   -  /proc
sysfs        sysfs           0         0         0   -  /sys
udev         tmpfs      187872       148    187724   1% /dev
tmpfs        tmpfs      192316         0    192316   0% /dev/shm
devpts      devpts           0         0         0   -  /dev/pts
fusectl    fusectl           0         0         0   -  /sys/fs/fuse/connections
pam_mount(pam_mount.c:521): mount of sshfs#pszubert@HOST: failed
command: 'pmvarrun' '-u' 'pszubert' '-o' '1' 
pam_mount(misc.c:38): set_myuid<pre>: (ruid/rgid=0/20001, e=0/20001)
pam_mount(misc.c:38): set_myuid<post>: (ruid/rgid=0/20001, e=0/20001)
pmvarrun(pmvarrun.c:248): parsed count value 0
pam_mount(pam_mount.c:440): pmvarrun says login count is 1
pam_mount(pam_mount.c:643): done opening session (ret=0)

In HOST auth.log there is info:

Mar 17 22:13:42 student sshd[17889]: Accepted password for pszubert from 85.202.159.212 port 20264 ssh2
Mar 17 22:13:42 student sshd[17889]: pam_unix(sshd:session): session opened for user pszubert by (uid=0)
Mar 17 22:13:42 student sshd[17891]: subsystem request for sftp
Mar 17 22:13:42 student sshd[17891]: Received disconnect from XXXXXXXXXX: 11: disconnected by user
Mar 17 22:13:42 student sshd[17889]: pam_unix(sshd:session): session closed for user pszubert

What is weird when I'm logged in I can mount remote fs using sshfs pszubert@HOST: a/.

What's wrong?

I think that problem is with ~/.ssh on local machine. First problem was about known_hosts file, so I created global known_hosts in /etc/ssh/ssh_known_hosts. Now ~/.ssh is still created, but is empty even if I connect to remote host manually. I think that if I could prevent of creation ~/.ssh it would solve problem. Is there a way to disable it?

Best Answer

I solved problem.

First I created global known_hosts file in /etc/ssh/ssh_known_hosts.

Main problem was visible in this line of debug:

command: 'pmt-fd0ssh' 'mount.fuse' 'sshfs#pszubert@HOST:' '/home/pszubert' '-oreconnect,idmap=user,password_stdin,nonempty'

As we can see there is no space between -o and options.

Adding line:

<fusemount>mount.fuse %(VOLUME) %(MNTPT) -o %(OPTIONS)</fusemount>

to pam_mount config file (/etc/security/pam_mount.conf.xml) solved problem. Now mount.fuse is called in tis way this:

command: 'pmt-fd0ssh' 'mount.fuse' 'sshfs#pszubert@HOST:' '/home/pszubert' '-o' 'reconnect,nonempty'

Next important things are permissions to /dev/fuse and /usr/bin/fusermount. User should be in fuse group. In my case it wasn't possible because it is remote user so I changed permissions manually:

chmod o+x /usr/bin/fusermount
chmod o+rw /dev/fuse

Related Solutions

Ssh – Username and password in command line with sshfs

-o password_stdin do not seem to be working on all systems, for instance freeBSD. etc.

You can also use expect Interpreter, it should work with sshfs and should do the trick.

Another solution would be sshpass, for instance, let say your are backing up directory /var/www

Backing up:

name=$(date '+%y-%m-%d')
mkdir /backup/$name && tar -czvf /backup/$name/"$name.tar.gz" /var/www

uploading backup file to backup server

sshpass -p "your_password" scp -r backup_user@target_ip:/home/ /backup/$name

So it will upload directory with today's backup

But still, as it was said higher, best(safe and simple) way would be to use ssh key pair
The only inconvenience would be that you have to go through the key generation process once on every server you need to pair, but it is better than keeping a password in plain text format on all servers you want to back up :),

Generating a Key Pair the Proper way

On Local server
```
ssh-keygen -t rsa
```

On remote Server

ssh root@remote_servers_ip "mkdir -p .ssh"

Uploading Generated Public Keys to the Remote Server

cat ~/.ssh/id_rsa.pub | ssh root@remote_servers_ip "cat >> ~/.ssh/authorized_keys"

Set Permissions on Remote server

ssh root@remote_servers_ip "chmod 700 ~/.ssh; chmod 640 ~/.ssh/authorized_keys"

Login
```
ssh root@remote_servers_ip
```
Enabling SSH Protocol v2

uncomment "Protocol 2" in /etc/ssh/sshd_config
enabling public key authorization in sshd

uncomment "PubkeyAuthentication yes" in /etc/ssh/sshd_config
If StrictModes is set to yes in /etc/ssh/sshd_config then
```
restorecon -Rv ~/.ssh
```

Best Answer

Related Solutions

Ssh – Username and password in command line with sshfs

Related Question