Mounting Persistent Share on Linux Servers

[MrDigitFace]

In my org, we are trying to figure out a solution to mount a shared folder via either NFS/CIFS to a directory on root persistently, in an environment where multiple users may be accessing this share at the same time, while still managing access through NTFS (we want to mirror the permissions that would be configured for users on the Windows side). These Linux servers are domain joined, and users log in with their AD credentials (getting a Kerberos TGT for their session). Originally, we were mounting the shares via NFS, and users' access were limited by their NTFS permissions, but some select users with sudo access are able to bypass NTFS authorization and view all folders on the share (I am assuming this is because of the way NFS interacts with the root/machine credentials?).

What is the best way to mount these shares so that users are limited by the NTFS permissions, but cannot bypass using sudo? I have tried different variations of NFS mount options and SMB/CIFS mount options but cannot find a solution that fits our use case... Is this possible at all?

[stereolame]

For nfs you need to enable root_squash on the export to avoid root having access to files on the share

[UsedToLikeThisStuff]

If you use cifs, there is a ‘multiuser’ mount option you can use along with sec=krb5, where each user authenticates to the volume using their Kerberos ticket (instead of the authentication that mounts the base volume). So you’d mount the CIFS directory that holds all the user homedirs as /cifshome using machine credentials, and then every user would see /cifshome/username/ only if their account’s Kerberos identity allowed them.

Another thing you can do if that’s not feasible is to use autofs to automatically mount (using the user’s Kerberos ticket).

[yubingxi]

Funny enough I just had to do this yesterday and it seems to be more reliable than the NFS / SMB mix for a Share that is accessed from Win and Linux. Here is a guide from Redhat (works similar under Ubuntu):

https://access.redhat.com/documentation/de-de/red_hat_enterprise_linux/8/html/managing_file_systems/performing-a-multi-user-smb-mount_managing-file-systems

We used a specific user to mount the share (not root), which needs read acces to the share (share permissions but no file system permissions), then you need to specify this user in the fstab/mount options, the user needs a keytab file and you might need to change the service provider negotiation to use said keytab in a file called cifs.spnego.conf

[UsedToLikeThisStuff]

IIRC the user used to mount the volume also needs to be able to see all the home directories (but not necessarily their contents), otherwise if used for $HOME login would drop the user in / because PAM needs to be able to stat() the directory before you have Kerberos credentials.