{"id":502,"date":"2017-04-19T01:40:43","date_gmt":"2017-04-18T18:40:43","guid":{"rendered":"http:\/\/www.rickyadams.com\/wp\/?p=502"},"modified":"2017-07-14T23:39:53","modified_gmt":"2017-07-14T16:39:53","slug":"linux-cifs-autofs-automount-using-kerberos-authentication-and-kinit","status":"publish","type":"post","link":"https:\/\/www.rickyadams.com\/wp\/linux-cifs-autofs-automount-using-kerberos-authentication-and-kinit\/","title":{"rendered":"Linux CIFS AutoFS (automount) using Kerberos Authentication and kinit"},"content":{"rendered":"
\n

Setup Linux CIFS AutoFS (automount) using kerberos\u00a0authentication<\/h1>\n
tatroc2015<\/a><\/span><\/span><\/div>\n<\/header>\n
\n

Written using CentOS 6, Windows 2012 Active Directory
\nThis guide was written assuming you already have Kerberos authentication working. In this post I will describe how to mount a Windows CIFS share from a Linux system using Kerberos authentication to a Windows Active Directory domain. In addition, the users credentials will be stored securely in a keytab file.<\/p>\n

Step 1. verify you can get a Kerberos ticket<\/p>\n

kinit testuser1@CORP.COMPANY.NET\r\nPassword for testuser1@CORP.COMPANY.NET:\r\n<\/pre>\n
klist\r\n\r\nTicket cache: FILE:\/tmp\/krb5cc_0\r\nDefault principal: testuser1@CORP.COMPANY.NET\r\n\r\nValid starting     Expires            Service principal\r\n03\/05\/15 13:57:02  03\/05\/15 23:57:02  krbtgt\/CORP.COMPANY.NET@CORP.COMPANY.NET\r\n        renew until 03\/12\/15 14:57:02\r\n<\/pre>\n
Step 2. Run kdestroy to clear the Kerberos cache<\/p>\n
kdestory\r\n<\/pre>\n
Step 3. Create a keytab file which will be used to store your credentials in an encrypted format. Later we will use the keytab file to get your Kerberos ticket<\/p>\n
-k specifies the keytype
\n-e specifies the encryption type
\nwkt writes the keytab file<\/p>\n
[user1@vm01 ~]$ ktutil\r\n    ktutil:  addent -password -p testuser1@CORP.COMPANY.NET -k 1 -e aes256-cts\r\n    Password for testuser1@CORP.COMPANY.NET: [enter your password]\r\n    ktutil:  wkt testuser1.keytab\r\n    ktutil:  quit\r\n<\/pre>\n
Step 4. Edit the auto.misc file, enter the share path<\/p>\n
vim \/etc\/auto.misc\r\n<\/pre>\n
share01             -fstype=cifs,rw,noperm,sec=krb5 :\/\/fileserver\/share01\r\n<\/pre>\n
Step 5. Create a crontab entry for root to refresh the Kerberos ticket every 12 hours<\/p>\n
crontab -e\r\n<\/pre>\n
CRON will run at 1AM and 1PM to refresh the Kerberos ticket<\/p>\n
0 1,13 * * *       \/usr\/bin\/kinit testuser1@CORP.COMPANY.NET -k -t \/root\/testuser1.keytab\r\n<\/pre>\n
Step 6. Wait for the crontab to run and verify that a Kerberos ticket is received.<\/p>\n
klist \r\n\r\nSOURCE: https:\/\/runops.wordpress.com\/2015\/03\/05\/setup-linux-cifs-autofs-automount-using-kerberos-authentication\/\r\n\r\n----------------------<\/pre>\n<\/div>\n
Creating a keytab file for the Kerberos service account (using the ktutil command on Linux)<\/strong><\/p>\n
This method of creating a keytab file on Linux uses the ktutil command.<\/p>\n
Prerequisites<\/strong><\/p>\n