This topic describes how to mount an SMB file system on a Linux client as an AD domain user. It also describes how to access the file system and manage Access Control Lists (ACLs) for its files and directories after it is mounted.
Prerequisites
-
The mount target of the SMB file system has been added to an AD domain. For more information, see Add the mount target of an SMB file system to an AD domain.
-
Use a Linux operating system version that is compatible with the SMB file system. For more information, see Limits and Recommended kernel images.
Background
Before you add the mount target of an SMB file system to an AD domain, you can only mount and use the file system as an anonymous user. After the mount target is added to the AD domain, you can choose whether to continue allowing access from anonymous users.
-
If you continue to allow anonymous access, clients can use Kerberos authentication to access the file system with a domain identity, or use NTLM authentication to access it as a member of the Everyone group.
-
If anonymous access is disallowed, only Linux clients that use the Kerberos authentication protocol can mount the file system as an AD domain user.
The following procedure uses Ubuntu and CentOS as examples to demonstrate how to mount and access an SMB file system as an AD domain user.
Method 1: Mount on a domain-joined client
-
Log on to the Linux client.
-
Join the Linux client to the AD domain.
-
-
Run the id command to check the status of an AD domain user.
id testuser@example-company.comOutput similar to the following indicates that the AD domain user is correctly identified.
[user1@mycentos root]$ id usera1@example-company.com uid=371801107(usera1@example-company.com) gid=371800513(domain users@example-company.com) groups=371800513(domain users@example-company.com) -
Grant logon permissions to AD domain users.
-
Grant logon permission to a specific user.
sudo realm permit usera1@example-company.com sudo realm permit userb1@example-company.com userb2@example-company.com -
Grant logon permission to a specific group.
sudo realm permit -g 'Security Users' sudo realm permit -g 'Domain Users' 'Domain Admins' -
Grant logon permission to all users.
sudo realm permit --all -
Deny logon permission to all users.
sudo realm deny --all
-
-
Add sudo permissions for an AD domain user.
Run the following command to open the sudo configuration file, and then add sudo permissions as needed.
sudo vim /etc/sudoers.d/domain_admins-
Add sudo permissions for a specific user.
usera1@example-company.com ALL=(ALL) ALL userb2@example-company.com ALL=(ALL) ALL -
Add sudo permissions for a specific group.
%admingroupc1@example-company.com ALL=(ALL) ALL -
Add sudo permissions for a group whose name contains multiple words.
%domain\ admins@example-company.com ALL=(ALL) ALL
-
-
Configure SSH logon.
-
Open the /etc/ssh/sshd_config configuration file and modify the logon setting as follows:
PasswordAuthentication yes -
Run the command for your operating system to restart the SSHD service.
-
CentOS
service sshd restart -
Ubuntu
service ssh restart
-
-
-
Log on to the Linux client as an AD domain user.
ssh localhost -l usera1@example-company.comOutput similar to the following indicates that you have successfully logged on to the Linux client as an AD domain user.
[user1@mycentos root]$ ssh localhost -l usera1@example-company.com The authenticity of host 'localhost (127.0.0.1)' can't be established. ECDSA key fingerprint is SHA256:t/sEr63muG4UvBiAODXW9cHuMDBUlWUXO3cQ4xxmN78. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added 'localhost' (ECDSA) to the list of known hosts. usera1@example-company.com@localhost's password: Welcome to Alibaba Cloud Elastic Compute Service ! Activate the web console with: systemctl enable --now cockpit.socket -
Mount the SMB file system.
-
Install the required mount tools.
-
Ubuntu
sudo apt-get install keyutils cifs-utils -
CentOS
sudo yum install keyutils cifs-utils
-
-
Query user and ticket information.
Run the id and
klistcommands to view the UID, GID, and ticket information for the current user.[usera1@example-company.com@mycentos ~]$ klist Ticket cache: KCM:371801107:64031 Default principal: usera1@EXAMPLE-COMPANY.COM Valid starting Expires Service principal 08/31/2021 07:56:42 08/31/2021 17:56:42 krbtgt/EXAMPLE-COMPANY.COM@EXAMPLE-COMPANY.COM renew until 09/07/2021 07:56:42 [usera1@example-company.com@mycentos ~]$ id uid=371801107(usera1@example-company.com) gid=371800513(domain users@example-company.com) groups=371800513(domain users@example-company.com),371801110(groupa@example-company.com) -
Run the following command to mount the file system.
sudo mount -t cifs //205dee4****-uub48.us-west-1.nas.aliyuncs.com/myshare /mnt -o vers=2.1,sec=krb5,cruid=371801107,uid=371801107,gid=371800513 --verboseReplace
205dee4****-uub48.us-west-1.nas.aliyuncs.comwith your file system's mount target address.NoteIf you selected Enable Encryption in Transit in the NAS console, you must use the vers=3.0 option to mount the file system.
-
-
Configure automatic mounting.
To automatically mount the file system after the Linux client restarts, configure automatic mounting.
-
In the /etc/auto.master configuration file, add the following line:
/share /etc/auto.cifs --timeout=30 --ghost -
Modify the /etc/auto.cifs configuration file as shown in the following example:
* -fstype=cifs,vers=2.1,sec=krb5,cruid=${UID},uid=${UID},gid=${GID},file_mode=0700,dir_mode=0700 ://205dee4****-uub48.us-west-1.nas.aliyuncs.com/myshare/&The following list describes the key parameters. Replace the values with your actual information.
-
cruidanduid: The ID of the local userusera1. -
gid: The group ID of the local userusera1. -
205dee4****-uub48.us-west-1.nas.aliyuncs.com: The mount target address.In the NAS console, navigate to the File System List page. Find your file system and click the
icon. In the resulting list, find the Mount Target column and hover over the 
icon to obtain the mount target address.
-
-
Restart the autofs service.
systemctl restart autofs.service -
Verify the automatic mount configuration.
For example, you create the //205dee4****-uub48.us-west-1.nas.aliyuncs.com/myshare/usera1 directory and grant the user
usera1full permissions.After you log on as the AD domain user, run the
ls /share/usera1command. If the contents of theusera1directory in the SMB file system are displayed, the automatic mount is configured correctly.
-
Method 2: Mount on a non-domain-joined client
-
Log on to the Linux client.
-
Connect to the AD server.
-
-
Use a local user account to obtain and cache the Kerberos ticket information.
-
Create a new local user and record the user's UID and GID.
useradd usera1 su - usera1 id[root@iZrj9gqbtl7kefeqxxx ~]# useradd usera1 [root@iZrj9gqbtl7kefeqxxx ~]# su - usera1 [usera1@iZrj9gqbtl7kefeqxxx ~]$ id uid=1004(usera1) gid=1004(usera1) groups=1004(usera1) -
As the new local user, obtain a Kerberos ticket for the AD user.
kinit administrator@EXAMPLE-COMPANY.COM klistuser1@iZrj9gqbtl7xxx :~$ kinit administrator@EXAMPLE-COMPANY.COM Password for administrator@EXAMPLE-COMPANY.COM: user1@iZrj9gqbtl7xxx :~$ klist Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: administrator@EXAMPLE-COMPANY.COM Valid starting Expires Service principal 09/08/2021 05:47:53 09/08/2021 15:47:53 krbtgt/EXAMPLE-COMPANY.COM@EXAMPLE-COMPANY.COM renew until 09/09/2021 05:47:49 user1@iZrj9gqbtl7xxx :~$
-
-
Mount the SMB file system.
-
Install the required mount tools.
-
Ubuntu
sudo apt-get install keyutils cifs-utils -
CentOS
sudo yum install keyutils cifs-utils
-
-
Run the following command to mount the file system.
sudo mount -t cifs //205dee4****-uub48.us-west-1.nas.aliyuncs.com/myshare /mnt -o vers=2.1,sec=krb5,cruid=1004,uid=1004,gid=1004 --verboseReplace
205dee4****-uub48.us-west-1.nas.aliyuncs.comwith your file system's mount target address.NoteIf you selected Enable Encryption in Transit in the NAS console, you must use the vers=3.0 option to mount the file system.
-
-
Configure automatic mounting.
To automatically mount the file system after the Linux client restarts, configure automatic mounting.
-
In the /etc/auto.master configuration file, add the following line:
/share /etc/auto.cifs --timeout=30 --ghost -
Modify the /etc/auto.cifs configuration file as shown in the following example:
* -fstype=cifs,vers=2.1,sec=krb5,cruid=${UID},uid=${UID},gid=${GID},file_mode=0700,dir_mode=0700 ://205dee4****-uub48.us-west-1.nas.aliyuncs.com/myshare/&The following list describes the key parameters. Replace the values with your actual information.
-
cruidanduid: The ID of the local userusera1. -
gid: The group ID of the local userusera1. -
205dee4****-uub48.us-west-1.nas.aliyuncs.com: The mount target address.In the NAS console, navigate to the File System List page. Find your file system and click the
icon. In the resulting list, find the Mount Target column and hover over the icon to obtain the mount target address.
-
-
Restart the autofs service.
systemctl restart autofs.service -
Verify the automatic mount configuration.
For example, you create the //205dee4****-uub48.us-west-1.nas.aliyuncs.com/myshare/usera1 directory and grant the user
usera1full permissions.After you log on as the AD domain user, run the
ls /share/usera1command. If the contents of theusera1directory in the SMB file system are displayed, the automatic mount is configured correctly.
-
Managing SMB ACLs with cifsacl
Use the getcifsacl and setcifsacl commands to manage ACLs for the SMB file system.
getcifsacl usera1/usera1@example-company.com@myubuntu:/mnt$ getcifsacl usera1/
REVISION:0x1
CONTROL:0x8404
OWNER:S-1-5-21-2849381876-3817135681-4198507328-1107
GROUP:S-1-5-21-2849381876-3817135681-4198507328-513
ACL:S-1-5-21-2849381876-3817135681-4198507328-1107:ALLOWED/I/FULL
ACL:S-1-3-0:ALLOWED/OI|CI|IO|I/FULL
ACL:S-1-5-18:ALLOWED/OI|CI|I/FULL
ACL:S-1-5-32-544:ALLOWED/OI|CI|I/FULL
ACL:S-1-5-21-3076751034-3769290925-1520581464-512:ALLOWED/OI|CI|I/FULLsudo setcifsacl -a "ACL:S-1-5-21-3076751034-3769290925-1520581464-513:ALLOWED/OI|CI|I/FULL" usera1/usera1@example-company.com@myubuntu:/mnt$ sudo setcifsacl -a "ACL:S-1-5-21-3076751034-3769290925-1520581464-513:ALLOWED/OI|CI|I/FULL" usera1/
usera1@example-company.com@myubuntu:/mnt$ getcifsacl usera1
REVISION:0x1
CONTROL:0x8004
OWNER:S-1-5-21-2849381876-3817135681-4198507328-1107
GROUP:S-1-5-21-2849381876-3817135681-4198507328-513
ACL:S-1-5-21-2849381876-3817135681-4198507328-1107:ALLOWED/I/FULL
ACL:S-1-3-0:ALLOWED/OI|CI|IO|I/FULL
ACL:S-1-5-18:ALLOWED/OI|CI|I/FULL
ACL:S-1-5-32-544:ALLOWED/OI|CI|I/FULL
ACL:S-1-5-21-3076751034-3769290925-1520581464-512:ALLOWED/OI|CI|I/FULL
ACL:S-1-5-21-3076751034-3769290925-1520581464-513:ALLOWED/OI|CI|I/FULL
usera1@example-company.com@myubuntu:/mnt$