Is It Possible to Mount SMB Share Using Kerberos Token of Current User on MacOS

DustinB3403

So I'm attempting to find a way via (unix) to map a connect to a server, and than the subsequent folders shared on on said server.

This is what I have, but I believe I am required to pass credentials. (Please tell me if there is a way to pull credentials from the logged in user).

pico /etc/auto_mount

Servers -fstype=smbfs :/<IP>/ShareName

sudo pico /etc/auto_master

/Users/shared/Servers auto_mount is what is in this file

sudo automount -cv

From what I can find it would appear I need to pass plaintext username and passwords via the first edited file. Which I obviously don't want to do.

scottalanmiller

Yes, that is normally what you have to do. Since SMB doesn't use keys, you need to use passwords. SMB is not designed around non-user mapping so has some odd security problems here.

DustinB3403

@scottalanmiller said in Is it possible to mount smb share using login credentials of current user.:

Yes, that is normally what you have to do. Since SMB doesn't use keys, you need to use passwords. SMB is not designed around non-user mapping so has some odd security problems here.

But I can do as shown here

Simply an example (not my server info)
https://support.apple.com/library/content/dam/edam/applecare/images/en_US/osx/yos_connect_to_server.png

and not have to pass separate credentials. The credentials are automatically pulled in using the domain users information.

scottalanmiller

@dustinb3403 said in Is it possible to mount smb share using login credentials of current user.:

@scottalanmiller said in Is it possible to mount smb share using login credentials of current user.:

Yes, that is normally what you have to do. Since SMB doesn't use keys, you need to use passwords. SMB is not designed around non-user mapping so has some odd security problems here.

But I can do as shown here

Simply an example (not my server info)
https://support.apple.com/library/content/dam/edam/applecare/images/en_US/osx/yos_connect_to_server.png

and not have to pass separate credentials. The credentials are automatically pulled in using the domain users information.

That's because you joined the domain and are using a kerberos key. You want to do something VERY different on your server since you don't want an end user logged in passing their personal credentials along like you do on the Mac desktop.

dbeato

Take a look below:
https://wiki.fogproject.org/wiki/index.php?title=Password_Protected_Samba_Share

scottalanmiller

If you do that mapping on the Mac, and then log in as another user, hopefully they can't see the files from the first user. If they can, that's even worse.

DustinB3403

@scottalanmiller said in Is it possible to mount smb share using login credentials of current user.:

@dustinb3403 said in Is it possible to mount smb share using login credentials of current user.:

@scottalanmiller said in Is it possible to mount smb share using login credentials of current user.:

Yes, that is normally what you have to do. Since SMB doesn't use keys, you need to use passwords. SMB is not designed around non-user mapping so has some odd security problems here.

But I can do as shown here

Simply an example (not my server info)
https://support.apple.com/library/content/dam/edam/applecare/images/en_US/osx/yos_connect_to_server.png

and not have to pass separate credentials. The credentials are automatically pulled in using the domain users information.

That's because you joined the domain and are using a kerberos key. You want to do something VERY different on your server since you don't want an end user logged in passing their personal credentials along like you do on the Mac desktop.

So what would be the recommended approach? I'm attempting to standardize our system setup for our mac user here, and as it is, we currently have to login as the user, and create the individual connections like above.

Which is time consuming to say the least, and incredibly annoying if we have to change anything.

DustinB3403

@scottalanmiller said in Is it possible to mount smb share using login credentials of current user.:

If you do that mapping on the Mac, and then log in as another user, hopefully they can't see the files from the first user. If they can, that's even worse.

This I'm not following, the goal is to create a central point that I can simply drag to an individual users desktop on any given mac, and have them connect to my Windows file server.

Since this is a shared resource (organizationally) they would presumably be able to see the files saved on this SMB server.

coliver

@dustinb3403 said in Is it possible to mount smb share using login credentials of current user.:

@scottalanmiller said in Is it possible to mount smb share using login credentials of current user.:

If you do that mapping on the Mac, and then log in as another user, hopefully they can't see the files from the first user. If they can, that's even worse.

This I'm not following, the goal is to create a central point that I can simply drag to an individual users desktop on any given mac, and have them connect to my Windows file server.

Since this is a shared resource (organizationally) they would presumably be able to see the files saved on this SMB server.

That should work. Once they login to the Mac and it's domain joined it should use the Kerberos token to authenticate.

DustinB3403

@dbeato this won't work as it would require us (IT dept) knowing people's passwords.

DustinB3403

@coliver said in Is it possible to mount smb share using login credentials of current user.:

@dustinb3403 said in Is it possible to mount smb share using login credentials of current user.:

@scottalanmiller said in Is it possible to mount smb share using login credentials of current user.:

If you do that mapping on the Mac, and then log in as another user, hopefully they can't see the files from the first user. If they can, that's even worse.

This I'm not following, the goal is to create a central point that I can simply drag to an individual users desktop on any given mac, and have them connect to my Windows file server.

Since this is a shared resource (organizationally) they would presumably be able to see the files saved on this SMB server.

That should work. Once they login to the Mac and it's domain joined it should use the Kerberos token to authenticate.

How would I pass the kerberos credentials into the mapping? Nothing I'm seeing appears to address it.

DustinB3403

The goal here, is to use the domain user credentials, regardless who it is, and what system they logon.

I want to be able to simply add this as a part of our image and just hand it out. Once the user logs into the system for the first time (and afterwards) IT would simply drag a "shortcut" to the task tray.

Rather than requiring the user to run "Command+K" and browsing the share as shown in the above example.

scottalanmiller

@dustinb3403 said in Is it possible to mount smb share using login credentials of current user.:

@coliver said in Is it possible to mount smb share using login credentials of current user.:

@dustinb3403 said in Is it possible to mount smb share using login credentials of current user.:

@scottalanmiller said in Is it possible to mount smb share using login credentials of current user.:

If you do that mapping on the Mac, and then log in as another user, hopefully they can't see the files from the first user. If they can, that's even worse.

This I'm not following, the goal is to create a central point that I can simply drag to an individual users desktop on any given mac, and have them connect to my Windows file server.

Since this is a shared resource (organizationally) they would presumably be able to see the files saved on this SMB server.

That should work. Once they login to the Mac and it's domain joined it should use the Kerberos token to authenticate.

How would I pass the kerberos credentials into the mapping? Nothing I'm seeing appears to address it.

Are you domain joined?

DustinB3403

@scottalanmiller yup.

scottalanmiller

@dustinb3403 said in Is it possible to mount smb share using login credentials of current user.:

@scottalanmiller said in Is it possible to mount smb share using login credentials of current user.:

If you do that mapping on the Mac, and then log in as another user, hopefully they can't see the files from the first user. If they can, that's even worse.

This I'm not following, the goal is to create a central point that I can simply drag to an individual users desktop on any given mac, and have them connect to my Windows file server.

Since this is a shared resource (organizationally) they would presumably be able to see the files saved on this SMB server.

Are they on Kerberos and have access to that share? Does the same thing work on Windows?

scottalanmiller

@dustinb3403 said in Is it possible to mount smb share using login credentials of current user.:

@scottalanmiller yup.

Okay, so this is a Mac? This isn't a question that can be asked generically. This depends on the SMB protocol server being used. Is this Mac, Samba, Windows, etc. That makes a difference. What is needed or will work for UNIX that isn't Mac doesn't apply to Mac because Mac doesn't use Samba and all other UNIX does.

scottalanmiller

The thing that you are trying to do, I think, is something that even Windows can't do. Or else I'm not understanding the goal. Can you explain it in a Windows context then we can translate to Mac or Samba?

DustinB3403

@scottalanmiller said in Is it possible to mount smb share using login credentials of current user.:

@dustinb3403 said in Is it possible to mount smb share using login credentials of current user.:

@scottalanmiller said in Is it possible to mount smb share using login credentials of current user.:

If you do that mapping on the Mac, and then log in as another user, hopefully they can't see the files from the first user. If they can, that's even worse.

This I'm not following, the goal is to create a central point that I can simply drag to an individual users desktop on any given mac, and have them connect to my Windows file server.

Since this is a shared resource (organizationally) they would presumably be able to see the files saved on this SMB server.

Are they on Kerberos and have access to that share? Does the same thing work on Windows?

On Windows I haven't investigated, but we simply create a shortcut for the user, and their domain credentials allow them access to the share.

We support Kerberos yes. I could open the share using Apple's "Connect to server" without having to type in additional credentials.

DustinB3403

@scottalanmiller said in Is it possible to mount smb share using login credentials of current user.:

@dustinb3403 said in Is it possible to mount smb share using login credentials of current user.:

@scottalanmiller yup.

Okay, so this is a Mac? This isn't a question that can be asked generically. This depends on the SMB protocol server being used. Is this Mac, Samba, Windows, etc. That makes a difference. What is needed or will work for UNIX that isn't Mac doesn't apply to Mac because Mac doesn't use Samba and all other UNIX does.

(tags buddy tags) although I should've put this bit into the OP.

DustinB3403

@scottalanmiller said in Is it possible to mount smb share using login credentials of current user.:

The thing that you are trying to do, I think, is something that even Windows can't do. Or else I'm not understanding the goal. Can you explain it in a Windows context then we can translate to Mac or Samba?

Windows World:

Create shortcut on desktop: Server1

Shortcut details

Target: \server.domain.com

Immediately opens the available shares on the server without having to pass additional credentials.