CentOS - Jun 2018 - [External] Re: Specifying different options for different " smb" type gvfs mount

On 21/06/18 14:09, John Hodrien wrote:
> On Thu, 21 Jun 2018, Toralf Lund wrote:
>
>> I known that I might use mount.cifs and related "fstab"
entries as an
>> alternative, but its password handling seems a lot less convenient.
>
> If you're in an AD environment, you can probably do nicely with 
> mount.cifs:
Well, I'm not. Or the CentOS machine is not configured for it, anyway. 
Might be possible to do, but I'm not entirely sure it would be worth the 
effort.

- Toralf

>
> sec=krb5,multiuser
>
> That way you don't have to deal with usernames/passwords at all.
>
> jh
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
>
https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.centos.org_mailman_listinfo_centos&d=DwICAg&c=KV_I7O14pmwRcmAVyJ1eg4Jwb8Y2JAxuL5YgMGHpjcQ&r=Q0oqxzgUp3xCCIiJDwS-RbNDndQ-KZDhj8wwveNoqU4&m=tjPm9TrBI_sodSKxipBHSBeTtrzqGiPQ-GvbwhbK8qo&s=54vPa_7ySn8NlCa0GF4dXQAAF-EYwEbbgBEY58kiWKA&e=
>

On Fri, Jun 22, 2018 at 03:43:56PM +0200, Toralf Lund
wrote:
> Well, I'm not. Or the CentOS machine is not configured for it, anyway.
Might
> be possible to do, but I'm not entirely sure it would be worth the
effort.
All you'd need is to use AD's kerberos realm for authentication and
have a username that matches the AD name.

(And honestly, if you are someplace with AD you probably should be
using at least the kerberos component, and possibly binding to the
domain so you can use it's account managemnt too.  You just need
patient AD admins.)

-- 
Jonathan Billings <billings at negate.org>

On Fri, 22 Jun 2018, Jonathan Billings wrote:
> On Fri, Jun 22, 2018 at 03:43:56PM +0200, Toralf Lund wrote:
>> Well, I'm not. Or the CentOS machine is not configured for it,
anyway. Might
>> be possible to do, but I'm not entirely sure it would be worth the
effort.
>
> All you'd need is to use AD's kerberos realm for authentication and
> have a username that matches the AD name.
You need more than that to do it securely, as you need a keytab.
> (And honestly, if you are someplace with AD you probably should be
> using at least the kerberos component, and possibly binding to the
> domain so you can use it's account managemnt too.  You just need
> patient AD admins.)
As long a s you have rights to add machines to the domain, you shouldn't
need
to bother the admins at all, unless you need to modify delegation permissions,
which only really affect windows clients anyway.

jh