Bdtyktl

I have a new install of Kubuntu 18.04.1, with user authentication via sssd to the company's Microsoft Active Directory.

Every user has a Samba share on //fileserver6/$USER and I want to mount it at login time.

I managed to get pam_mount configured to mount the share whenever the user logs in, and it was working fine... until I logged out of KDE, and discovered that the sddm-greeter didn't work!

Instead of a login prompt, there's just a black screen with a mouse pointer. In the below pam_mount.conf.xml, I can comment out the <volume> tag, and log in via sddm, then I can uncomment it and log into a terminal session, and the directory is automounted. But I can't have both!

Failing a solution to the problem, I'll happily install another display manager if it works (lightdm won't even let me choose a user). [ETA: lxdm does work]

/etc/security/pam_mount.conf.xml

<?xml version="1.0" encoding="utf-8" ?>

<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">

<!--

    See pam_mount.conf(5) for a description.

-->



<pam_mount>



        <!-- debug should come before everything else,

        since this file is still processed in a single pass

        from top-to-bottom -->



<debug enable="0" />



        <!-- Volume definitions -->

<volume user="*" fstype="cifs" server="fileserver6" path="%(USER)" 

        mountpoint="/media/%(USER)/p" options="cruid=%(USER),sec=krb5" />



        <!-- pam_mount parameters: General tunables -->



<luserconf name=".pam_mount.conf.xml" />



<!-- Note that commenting out mntoptions will give you the defaults.

     You will need to explicitly initialize it with the empty string

     to reset the defaults to nothing. -->

<mntoptions allow="nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other" />

<!--

<mntoptions deny="suid,dev" />

<mntoptions allow="*" />

<mntoptions deny="*" />

-->

<mntoptions require="nosuid,nodev" />



<!-- requires ofl from hxtools to be present -->

<logout wait="0" hup="no" term="no" kill="no" />





        <!-- pam_mount parameters: Volume-related -->



<mkmountpoint enable="1" remove="true" />



</pam_mount>

/etc/pam.d/sddm

auth    requisite       pam_nologin.so

auth    required        pam_succeed_if.so user != root quiet_success



@include common-auth

-auth   optional        pam_gnome_keyring.so

-auth   optional        pam_kwallet.so

-auth   optional        pam_kwallet5.so



@include common-account



session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close

session optional        pam_keyinit.so force revoke

session required        pam_limits.so

session required        pam_loginuid.so

@include common-session

session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open

-session optional       pam_gnome_keyring.so auto_start

-session optional       pam_kwallet.so auto_start

-session optional       pam_kwallet5.so auto_start



@include common-password

session required        pam_env.so

session required        pam_env.so envfile=/etc/default/locale

/etc/pam.d/sddm-greeter

auth    required        pam_permit.so

@include common-account

session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close

session optional        pam_keyinit.so force revoke

session required        pam_limits.so

session required        pam_loginuid.so

@include common-session

session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open



password        required pam_deny.so

session required        pam_env.so

session required        pam_env.so envfile=/etc/default/locale

/etc/pam.d/common-session

session [default=1]                     pam_permit.so

session requisite                       pam_deny.so

session required                        pam_permit.so

session optional                        pam_umask.so

session required        pam_unix.so 

session optional                        pam_sss.so 

session optional        pam_mount.so 

session optional        pam_systemd.so 

session optional                        pam_mkhomedir.so 

/etc/pam.d/common-auth

auth    [success=2 default=ignore]      pam_unix.so nullok_secure

auth    [success=1 default=ignore]      pam_sss.so use_first_pass

auth    requisite                       pam_deny.so

auth    required                        pam_permit.so

auth    optional        pam_mount.so 

auth    optional                        pam_cap.so 

/etc/pam.d/common-password

password        requisite                       pam_pwquality.so retry=3

password        [success=2 default=ignore]      pam_unix.so obscure use_authtok try_first_pass sha512

password        sufficient                      pam_sss.so use_authtok

password        requisite                       pam_deny.so

password        required                        pam_permit.so

password        optional        pam_mount.so disable_interactive

password        optional        pam_gnome_keyring.so