2018 - Networked home directories in Linux (autofs)

category: howtoz · date: 2018-01-01 · updated: 2019-01-08

The Slovak original of this document: 2018-network-home-directories-autofs (slovensky).

Networked home directories in Linux

1 Introduction

This short article is about mounting users' networked (CIFS) home directories on a server (Server3) automatically with the automounter (AUTOFS), where the home directories are served by another machine (Server2) running SAMBA. A home directory is mounted only after Kerberos authentication has succeeded. It follows that the users and both servers have to be able to work with Kerberos tickets, since the mounting server (Server3) uses the user's Kerberos ticket to authenticate to the SAMBA server (Server2). The simplest way to arrange that is to join both servers to a Windows domain and keep the users in Microsoft Active Directory. For this reason a Windows server (Server1) running Microsoft Active Directory also appears here, holding the Windows domain DOMENA.SK. RHEL 7.4 was used for the testing.

2 Components

Server1 (domain controller) - This server acts as the Microsoft Active Directory server, that is, as the domain controller.

Server2 (file server) - This server serves networked home directories, with CIFS (Common Internet File System) as the network file system. SAMBA is used for this. The server is joined to the Windows domain DOMENA.SK.

Server3 (user server) - This is the machine users connect to over SSH or SCP, and where their networked home directories are mounted. The automounter (AUTOFS) is used for the mounting. The server is joined to the Windows domain DOMENA.SK, and SSSD integrates it with Microsoft Active Directory.

Note 1: Installing and configuring Active Directory (Server1) is not the subject of this article.
Note 2: Integrating Linux servers with Microsoft Active Directory (the SSSD software) is not the subject of this article.

3 The file server (Server2)

3.1 Installing what is needed (SAMBA)

asciiart

# yum install samba

3.2 Configuring SAMBA

Creating the directory structure for the users' home directories.

asciiart

# mkdir -p /homedirs/user1
# mkdir -p /homedirs/user2
# mkdir -p /homedirs/user3
...

Changing the permissions on the users' home directories.

asciiart

# chown user1:group /homedirs/user1
# chmod 0700 /homedirs/user1
# chown user2:group /homedirs/user2
# chmod 0700 /homedirs/user2
# chown user3:group /homedirs/user3
# chmod 0700 /homedirs/user3
...

Configuring SAMBA.

asciiart

# vi /etc/samba/smb.conf
-------------------------------------------------------------------------
[global]
        workgroup = DOMENA
        client signing = yes
        client use spnego = yes
        server signing = mandatory
        kerberos method = secrets and keytab
        log file = /var/log/samba/log.%m
        log level = 0
        realm = DOMENA.SK
        security = ads

[homedirs]
        comment = Users Network home directories
        path = /homedirs
        writable = yes
        read only = no
        force create mode = 0600
        create mask = 0700
        directory mask = 0700
        force directory mode = 0700
        access based share enum = yes

Starting SAMBA.

asciiart

# systemctl start smb

Starting SAMBA at boot.

asciiart

# systemctl enable smb

4 The user server (Server3) - variant 1

Variant 1 is the case where whole home directories are mounted on the user server directly under /home/, so the user part of /home/user is located on the file server.

4.1 Installing what is needed (AUTOFS)

asciiart

# yum install autofs
# yum install cifs-utils

4.2 User space - "request-key" and "cifs.upcall"

Mounting the CIFS network filesystem with Kerberos authentication needs the right user-space configuration. The reason is that when the kernel mounts a CIFS filesystem it needs the Kerberos tickets, and those live in user space (by default under /tmp). To get them, the kernel runs the program request-key, which reads /etc/request-key.conf to learn what to do with the request and how to reach the tickets. For a CIFS mount with Kerberos authentication, request-key runs the helper cifs.upcall.

4.2.1 Checking the system for the configuration user space needs

Check whether the system has the user-space configuration it needs. On RHEL 7 none is required, because installing the cifs-utils package brings it. All we need here is the file cifs.spnego.conf, because we authenticate through SPNEGO (the Windows domain, Kerberised).

asciiart

# ls -lh /etc/request-key.d/
-------------------------------------------------------------------------
-rw-r--r-- 1 root root 50 Apr  3  2017 cifs.idmap.conf
-rw-r--r-- 1 root root 52 Nov 23 17:04 cifs.spnego.conf

4.2.2 Adjusting the configuration in user space

If the files from 4.2.1 exist, adjust the configuration by adding the -t switch.

asciiart

# vi /etc/request-key.d/cifs.spnego.conf
-------------------------------------------------------------------------
ORIGINAL: create cifs.spnego     *       *               /usr/sbin/cifs.upcall %k
CHANGED : create cifs.spnego     *       *               /usr/sbin/cifs.upcall -t %k

4.2.3 Creating the configuration in user space

If the files from 4.2.1 do not exist, create the configuration by adding to /etc/request-key.conf.

asciiart

# vi /etc/request-key.conf
-------------------------------------------------------------------------
...
# LH-ON
create cifs.idmap      *       *               /usr/sbin/cifs.idmap %k
create cifs.spnego     *       *               /usr/sbin/cifs.upcall -t %k

4.3 Configuring the automounter (AUTOFS)

Editing the AUTOFS master configuration file.

asciiart

# vi /etc/auto.master
-------------------------------------------------------------------------
+auto.master
...
# Mount point we  | Detailed mount      | Further parameters.
# want to mount   | instructions are    |
# into.           | here.               |
/home              /etc/auto.cifshome    --timeout 20

Creating a specific configuration file, with detailed mount instructions, for mounting the networked home directories.

asciiart

# vi /etc/auto.cifshome
-------------------------------------------------------------------------
* -fstype=cifs,sec=krb5i,uid=$UID,gid=$GID,cruid=$UID,file_mode=0600,dir_mode=0700 ://CIFS_SERVER/homedirs/&

5 The user server (Server3) - variant 2

Variant 2 is the case where whole home directories are mounted on the user server directly at /home/user.

5.1 Configuring AUTOFS

Because AUTOFS is limited in how it can use wildcards, this variant uses a helper script.

5.1.1 The script "home-cifs-link.sh"

The script and the rest of variant 2 were never written up.

Current practice (checked 2026-10)

noteThe article above is kept as it was written in 2018. This section lists what has changed since and what to do instead today.

Platform: RHEL 7 left maintenance support on 30 June 2024. On current Enterprise Linux releases the packages have the same names (samba, autofs, cifs-utils), yum is dnf, and cifs-utils still installs /etc/request-key.d/cifs.spnego.conf, so the design of the article carries over.
cifs.upcall -t: step 4.2.2 adds -t (--trust-dns). The man page calls this less secure: the client reverse-resolves the server address to build the service principal, so whoever controls DNS can make it mount a different server. Leave the stock line without -t and put a server name into the map that matches the file server's principal in Active Directory.
Where the tickets are: the article says the Kerberos tickets are under /tmp. cifs.upcall reads $KRB5CCNAME from the process that triggered the mount and otherwise uses the default cache from krb5.conf, so it also works with KEYRING: and KCM: caches, where there are no ticket files in /tmp at all.
client use spnego: deprecated since Samba 4.13; yes is the default and will become the only behaviour. Remove the line from smb.conf.
Signing and encryption: sec=krb5i and server signing = mandatory protect integrity only, the file contents still cross the network in clear. Today require SMB3 encryption: add seal to the mount options in /etc/auto.cifshome and set server smb encrypt = required on the share (or in [global]).
SMB1: nothing to do. Samba's default server min protocol is SMB2_02, so the server no longer accepts SMB1 unless you lower it; do not add vers=1.0 to the map.

ini

[homedirs]
        server smb encrypt = required

Sources: