Post by Alexander BokovoyPost by John ObaterspokPost by Jakub HrozekPost by John ObaterspokPost by Gianluca CecchiTo get the whole root environment you have to run
su - root
did you try with it?
ahh... that works fine Gianluca!
-rwxr-----. 1 root admins 12 11 jan 10.42 test.txt
Should I be able to access it if I aquire an admin ticket? Currently I
get
Post by John ObaterspokPermission denied
uid=1434400004(john) gid=1434400004(john) grupper=1434400004(john)
context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
# file: test.txt
# owner: root
# group: admins
user::rwx
group::r--
other::---
uid=1434400000(admin) gid=1434400000(admins) groups=1434400000(admins)
Ticket cache: KEYRING:persistent:1434400004:krb_ccache_MVjxTqf
Valid starting Expires Service principal
cat: test.txt: Permission denied
Looks like your account needs to be in the 'admins' group in order to
access the file.
Acquiring the admin ticket doesn't switch the user ID nor add you to the
group..
I thought the krb5 mount option would allow ticked based access to the
file.
Is the purpose of the krb5 mount option just used during mounting of the
share? Otherwise I see no difference compared to not using krb5 mount
option!?
Its purpose is authentication. After you have been successfully
recognized by the server, both client and server need to map your
identity while authorizing your access to actual files.
In CIFS there are two types of access control which are applied at the
- ACLs per file or directory
- POSIX access control based on uid/gid of a process that accesses the
file or directory
Client-side checks in cifs.ko can be switched off by noperm option. In
this case server side will be doing actual access enforcement, using the
uid/gid mapped on the server side (based on the Kerberos principal),
unless CIFS Unix Extensions were negotiated between cifs.ko and the
server. In the latter case client will pass uid/gid of a client to the
server and server will do the actual check using them instead of
discovering them based on the authentication token.
In case where there is a common identity store in use with Kerberos, it
is often better to use cifs.ko option multiuser which will imply noperm
and server will be doing all the checks.
Simo also added that "You need to pass the 'multiuser' option at mount time
for that, the
default for cifs.ko is still to just use the mount credentials."
Well, I were actually using multiuser in the original test where I got
"permission denied" but there is something weird going on.
mount -t cifs //ipaserver.MY.LAN/Share -o sec=krb5,multiuser mountpoint (I
also tried -o sec=krb5,multiuser,cache=none)
Anyway, it works if I do the mount as root and then as user john gets the
admin ticket *before* going to the share. Then it doesn't matter if I do
kdestroy, I can still access a file that would require admin ticket.
If I remount the share and go to share as john without admin ticket I can't
access a file that would require admin ticket. If I get an admin ticket
then I'm still not able to access the file.
[***@ipaserver mountpoint]$ ll test.txt
-rwxr-----. 1 root admins 12 11 jan 10.42 test.txt
[***@ipaserver mountpoint]$ cat test.txt
Hello World
[***@ipaserver mountpoint]$ id john
uid=1434400004(john) gid=1434400004(john)
groups=1434400004(john),1434400010(mediafiles)
[***@ipaserver mountpoint]$ klist
Ticket cache: KEYRING:persistent:1434400004:krb_ccache_Ri45Eiw
Default principal: ***@MY.LAN
Valid starting Expires Service principal
2015-01-14 21:54:24 2015-01-15 21:53:57 cifs/***@MY.LAN
2015-01-14 21:53:59 2015-01-15 21:53:57 krbtgt/***@MY.LAN
[***@ipaserver mountpoint]$ kdestroy
[***@ipaserver mountpoint]$ klist
klist: Credentials cache keyring 'persistent:1434400004:krb_ccache_Ri45Eiw'
not found
[***@ipaserver mountpoint]$ cat test.txt
Hello World
[***@ipaserver mountpoint]$ klist
klist: Credentials cache keyring 'persistent:1434400004:krb_ccache_Ri45Eiw'
not found
-------------------------------------------------------------
---------- then remount share. john has non-admin ticket ----
-------------------------------------------------------------
[***@ipaserver mountpoint]$ id
uid=1434400004(john) gid=1434400004(john)
groups=1434400004(john),1434400010(mediafiles)
kontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[***@ipaserver mountpoint]$ klist
Ticket cache: KEYRING:persistent:1434400004:krb_ccache_RiwpwLT
Default principal: ***@MY.LAN
Valid starting Expires Service principal
2015-01-14 22:16:00 2015-01-15 22:15:55 cifs/***@MY.LAN
2015-01-14 22:15:58 2015-01-15 22:15:55 krbtgt/***@MY.LAN
[***@ipaserver mountpoint]$ ll test.txt
-rwxr-----. 1 root admins 12 11 jan 10.42 test.txt
[***@ipaserver mountpoint]$ cat test.txt
cat: test.txt: Permission denied
[***@ipaserver mountpoint]$ kinit admin
Password for ***@MY.LAN:
[***@ipaserver mountpoint]$ cat test.txt
cat: test.txt: Permission denied
[***@ipaserver mountpoint]$ klist
Ticket cache: KEYRING:persistent:1434400004:krb_ccache_H7RvRpA
Default principal: ***@MY.LAN
Valid starting Expires Service principal
2015-01-14 22:16:24 2015-01-15 22:16:22 krbtgt/***@MY.LAN
Any ideas?
-- john