Re: configure /etc/pam.d/crond to use pam_mount
Simone Gaiarin <[email protected]> Sun, 09 Oct 2016 08:02:11 +0000
| Newsgroups | gmane.linux.pam |
|---|---|
| Message-ID | <CAO-ExufWkDJgTAz+B2YT-QWP=oN4s5b_wCB7FxzDEvekwDNi4A@mail.gmail.com> |
--===============1557445246980353736== Content-Type: multipart/alternative; boundary=001a1145447623f8bc053e6a10c5 --001a1145447623f8bc053e6a10c5 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable I'm sorry. I'll try to explain my problem better. Short version: Cron jobs cannot access the content of the encrypted disk even when I'm logged in. I can access the content of the disk from bash or graphical file explorer. Longer version: I've first seen problem because I'm using backintime to perform automatic backup of my disk. When I run the backup manually everything is fine, while when the backup is performed automatically with cron the resulting backup is always empty. Adding the follwing command to crontab (using crontab -e), in order to list the content of the drive (/media/dataHD), show me that the ls of the drive doesn't produce any result. */1 * * * * ls -la /media /media/dataHD /media/dataHD/work > /tmp/filelist I've the following configuration files (based on this guide https://wiki.archlinux.org/index.php/Talk:Pam_mount): /etc/pam.d/pammount (I've created this file) #%PAM-1.0 auth optional pam_mount.so password optional pam_mount.so session optional pam_mount.so /etc/pam.d/system-local-login #%PAM-1.0 auth include system-login auth include pammount account include system-login account include pammount password include system-login password include pammount session include system-login session include pammount /etc/pam.d/sddm #%PAM-1.0 auth include system-login auth include pammount account include system-login account include pammount password include system-login password include pammount session include system-login session include pammount I hope I've been more clear now. Thanks On Sun, Oct 9, 2016 at 8:16 AM Thorsten Kukuk <[email protected]> wrote: On Sat, Oct 08, Simone Gaiarin wrote: > pam_mount decrypt the disk using the password the user input in the login > screen of the OS. Now in the moment I'm logged in and the disk is decrypted > how can I make cron see the disk? I'm not interested in having cron running > jobs when I'm not logged in (and so the disk is encrypted). At the moment, where your user is logged in, everybody can see the disk, even cron. No pam_mount is needed there for cron. Maybe you should explain at first what your problem exactly is and not start with a solution first? Thorsten -- Thorsten Kukuk, Senior Architect SLES & Common Code Base SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nuernberg, Germany GF: Felix Imend=C3=B6rffer, Jane Smithard, Graham Norton, HRB 21284 (AG N= =C3=BCrnberg) _______________________________________________ Pam-list mailing list [email protected] https://www.redhat.com/mailman/listinfo/pam-list --001a1145447623f8bc053e6a10c5 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div dir=3D"ltr" class=3D"gmail_msg">I'm sorry. I'= ll try to explain my problem better.<div class=3D"gmail_msg"><br class=3D"g= mail_msg"></div><div class=3D"gmail_msg">Short version: Cron jobs cannot ac= cess the content of the encrypted disk even when I'm logged in. I can a= ccess the content of the disk from bash or graphical file explorer.</div><d= iv class=3D"gmail_msg"><br class=3D"gmail_msg"></div><div class=3D"gmail_ms= g">Longer version:</div><div class=3D"gmail_msg">I've first seen proble= m because I'm using backintime to perform automatic backup of my disk. = When I run the backup manually everything is fine, while when the backup is= performed automatically with cron the resulting backup is always empty.<br= class=3D"gmail_msg"></div><div class=3D"gmail_msg"><br class=3D"gmail_msg"= ></div><div class=3D"gmail_msg">Adding the follwing command to crontab (usi= ng crontab -e), in order to list the content of the drive (/media/dataHD), = show me that the ls of the drive doesn't produce any result.</div><div = class=3D"gmail_msg"><pre style=3D"box-sizing:border-box;font-family:consola= s,"liberation mono",menlo,courier,monospace;font-size:11.9px;marg= in-top:0px;margin-bottom:16px;font-stretch:normal;line-height:1.45;word-wra= p:normal;padding:16px;overflow:auto;background-color:rgb(247,247,247);borde= r-radius:3px;color:rgb(51,51,51)" class=3D"gmail_msg"><code style=3D"box-si= zing:border-box;font-family:consolas,"liberation mono",menlo,cour= ier,monospace;font-size:11.9px;padding:0px;margin:0px;background-image:init= ial;background-position:initial;background-size:initial;background-repeat:i= nitial;background-origin:initial;background-clip:initial;background-color:t= ransparent;border-radius:3px;word-break:normal;border:0px;display:inline;ov= erflow:visible;line-height:inherit;word-wrap:normal" class=3D"gmail_msg">*/= 1 * * * * ls -la /media /media/dataHD /media/dataHD/work > /tmp/filelist= </code></pre><br class=3D"gmail_msg"></div><div class=3D"gmail_msg">I'v= e the following configuration files (based on this guide <a href=3D"https:/= /wiki.archlinux.org/index.php/Talk:Pam_mount">https://wiki.archlinux.org/in= dex.php/Talk:Pam_mount</a>):</div><div class=3D"gmail_msg"><br></div><div c= lass=3D"gmail_msg">/etc/pam.d/pammount (I've created this file)</div><d= iv class=3D"gmail_msg"><span style=3D"font-family:monospace" class=3D"gmail= _msg"><br class=3D"gmail_msg"></span></div>#%PAM-1.0 <br class=3D"gmail_msg= "><br class=3D"gmail_msg">auth =C2=A0 =C2=A0 =C2=A0optional =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 pam_mount.so <br class=3D"= gmail_msg">password =C2=A0optional =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 pam_mount.so <br class=3D"gmail_msg">session =C2= =A0 optional =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= pam_mount.so<div class=3D"gmail_msg"><br class=3D"m_-2584202530360875353in= box-inbox-Apple-interchange-newline gmail_msg"></div></div>/etc/pam.d/syste= m-local-login<div><span style=3D"font-family:monospace">#%PAM-1.0 <br> <br>auth =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0include =C2=A0=C2=A0system-login <br>auth =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0include =C2=A0=C2=A0pammount <br>account =C2=A0=C2=A0include =C2=A0=C2=A0system-login <br>account =C2=A0=C2=A0include =C2=A0=C2=A0pammount <br>password =C2=A0include =C2=A0=C2=A0system-login <br>password =C2=A0include =C2=A0=C2=A0pammount <br>session =C2=A0=C2=A0include =C2=A0=C2=A0system-login <br>session =C2=A0=C2=A0include =C2=A0=C2=A0pammount</span></div><div><span= style=3D"font-family:monospace"><br></span></div><div><span style=3D"font-= family:monospace">/etc/pam.d/sddm</span></div><div><span style=3D"font-fami= ly:monospace"><br> </span><span style=3D"font-family:monospace">#%PAM-1.0 <br> <br>auth =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0include =C2=A0=C2=A0=C2= =A0=C2=A0system-login <br>auth =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= include =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0pammount <br>account =C2=A0=C2=A0=C2=A0=C2=A0include =C2=A0=C2=A0=C2=A0=C2=A0system-= login <br>account =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0include =C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0pammount <br>password =C2=A0=C2=A0=C2=A0include =C2=A0=C2=A0=C2=A0=C2=A0system-login <br>password =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0include =C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0pammount <br>session =C2=A0=C2=A0=C2=A0=C2=A0include =C2=A0=C2=A0=C2=A0=C2=A0system-= login <br>session =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0include =C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0pammount<br> <br>I hope I've been more clear now.</span></div><div><span style=3D"fo= nt-family:monospace"><br></span></div><div><span style=3D"font-family:monos= pace">Thanks</span></div><div><span style=3D"font-family:monospace"><br></s= pan><div class=3D"gmail_quote gmail_msg"><div dir=3D"ltr" class=3D"gmail_ms= g">On Sun, Oct 9, 2016 at 8:16 AM Thorsten Kukuk <<a href=3D"mailto:kuku= [email protected]" class=3D"gmail_msg" target=3D"_blank">[email protected]</a>> wrot= e:<br class=3D"gmail_msg"></div><blockquote class=3D"gmail_quote gmail_msg"= style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On= Sat, Oct 08, Simone Gaiarin wrote:<br class=3D"gmail_msg"><br><br class=3D= "gmail_msg"><br>> pam_mount decrypt the disk using the password the user= input in the login<br class=3D"gmail_msg"><br>> screen of the OS. Now i= n the moment I'm logged in and the disk is decrypted<br class=3D"gmail_= msg"><br>> how can I make cron see the disk? I'm not interested in h= aving cron running<br class=3D"gmail_msg"><br>> jobs when I'm not lo= gged in (and so the disk is encrypted).<br class=3D"gmail_msg"><br><br clas= s=3D"gmail_msg"><br>At the moment, where your user is logged in, everybody = can see<br class=3D"gmail_msg"><br>the disk, even cron. No pam_mount is nee= ded there for cron.<br class=3D"gmail_msg"><br><br class=3D"gmail_msg"><br>= Maybe you should explain at first what your problem exactly is<br class=3D"= gmail_msg"><br>and not start with a solution first?<br class=3D"gmail_msg">= <br><br class=3D"gmail_msg"><br>=C2=A0 Thorsten<br class=3D"gmail_msg"><br>= <br class=3D"gmail_msg"><br>--<br class=3D"gmail_msg"><br>Thorsten Kukuk, S= enior Architect SLES & Common Code Base<br class=3D"gmail_msg"><br>SUSE= LINUX GmbH, Maxfeldstr. 5, 90409 Nuernberg, Germany<br class=3D"gmail_msg"= ><br>GF: Felix Imend=C3=B6rffer, Jane Smithard, Graham Norton, HRB 21284 (A= G N=C3=BCrnberg)<br class=3D"gmail_msg"><br><br class=3D"gmail_msg"><br>___= ____________________________________________<br class=3D"gmail_msg"><br>Pam= -list mailing list<br class=3D"gmail_msg"><br><a href=3D"mailto:Pam-list@re= dhat.com" class=3D"gmail_msg" target=3D"_blank">[email protected]</a><br = class=3D"gmail_msg"><br><a href=3D"https://www.redhat.com/mailman/listinfo/= pam-list" rel=3D"noreferrer" class=3D"gmail_msg" target=3D"_blank">https://= www.redhat.com/mailman/listinfo/pam-list</a><br class=3D"gmail_msg"><br></b= lockquote></div></div></div> --001a1145447623f8bc053e6a10c5-- --===============1557445246980353736== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Pam-list mailing list [email protected] https://www.redhat.com/mailman/listinfo/pam-list --===============1557445246980353736==--