From: "Aurélien Aptel" <aaptel@suse.com>
To: Shyam Prasad N <nspmangalore@gmail.com>
Cc: CIFS <linux-cifs@vger.kernel.org>,
samba-technical@lists.samba.org,
Pavel Shilovsky <piastryyy@gmail.com>,
Steve French <smfrench@gmail.com>,
sribhat.msa@outlook.com
Subject: Re: [PATCH][SMB3] mount.cifs integration with PAM
Date: Wed, 09 Sep 2020 16:13:16 +0200 [thread overview]
Message-ID: <874ko7vy0z.fsf@suse.com> (raw)
In-Reply-To: <CANT5p=qMHxq_L5RpXAixzrQztjMr8-P_aO4aPg5uqfPSLNUiTA@mail.gmail.com>
Shyam Prasad N <nspmangalore@gmail.com> writes:
> Thoughts?
You are reaching the limits of my poor understanding of this kerberos
stuff. What is the difference between keytab and credential cache?
So IIUC you are proposing 2 ways to go about it:
a) - do PAM login in mount.cifs (which in turns calls into sssd/winbind)
- implement umount.cifs for PAM logoff
b) - ignore PAM and winbind/sssd and do kinit in mount.cifs manually
- would this requires umount.cifs as well?
I like (b) because it feels we have more control and don't require a big
external program like winbind *but* if (b) doesn't do the refreshing of
the tickets then the mount will always stop working after they
expire. This seems only useful for quick one-off mounting or
testing/debugging. Real end users will find it unreliable unless they
setup something like what winbind does essentially.
So ultimately, to me, (a) seems like the better choice. Let me know if I
misunderstood something.
Cheers,
--
Aurélien Aptel / SUSE Labs Samba Team
GPG: 1839 CB5F 9F5B FB9B AA97 8C99 03C8 A49B 521B D5D3
SUSE Software Solutions Germany GmbH, Maxfeldstr. 5, 90409 Nürnberg, DE
GF: Felix Imendörffer, Mary Higgins, Sri Rasiah HRB 247165 (AG München)
next prev parent reply other threads:[~2020-09-09 16:24 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-14 5:45 [PATCH][SMB3] mount.cifs integration with PAM Shyam Prasad N
2020-08-14 9:52 ` Aurélien Aptel
[not found] ` <CANT5p=oeY91u17DPe6WO75Eq_bjzrVC0kmAErrZ=h3S1qh-Wxw@mail.gmail.com>
2020-08-17 8:48 ` Aurélien Aptel
[not found] ` <CANT5p=rxp3iQMgxaM_mn3RE3B+zezWr3o8zpkFyWUR27CpeVCA@mail.gmail.com>
2020-09-09 11:04 ` Shyam Prasad N
2020-09-09 14:13 ` Aurélien Aptel [this message]
2020-09-09 17:25 ` Shyam Prasad N
2020-09-10 9:43 ` Aurélien Aptel
2020-09-23 12:06 ` Shyam Prasad N
2020-09-23 13:56 ` Aurélien Aptel
2020-09-24 10:39 ` Shyam Prasad N
2020-11-09 23:42 ` Pavel Shilovsky
2020-11-10 13:20 ` Shyam Prasad N
2020-11-10 19:22 ` Pavel Shilovsky
2020-11-27 10:43 ` Shyam Prasad N
2020-12-14 18:03 ` Stefan Metzmacher
[not found] ` <CANT5p=rYiY0xE-35swsFKVitZD2yTchRiReyA0wVvY+mU_qKEw@mail.gmail.com>
2021-01-30 14:24 ` Shyam Prasad N
2021-02-01 10:51 ` Aurélien Aptel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=874ko7vy0z.fsf@suse.com \
--to=aaptel@suse.com \
--cc=linux-cifs@vger.kernel.org \
--cc=nspmangalore@gmail.com \
--cc=piastryyy@gmail.com \
--cc=samba-technical@lists.samba.org \
--cc=smfrench@gmail.com \
--cc=sribhat.msa@outlook.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).