Mounting at login/logout instead of in fstab - pam.mount

[oshunluvr]

As I talked about here, I wanted to move my personal media folders to my server so my Documents, etc. are available from numerous places on my network without having my Desktop PC running. Also, my server has automated backups so my personal stuff will be a bit more secure this way. I tried and failed using systemd to do this (see the above link). Eventually, during my research I got a hint that PAM (Pluggable Authentication Modules) had this feature, called logically enough - pam.mount.

This is sort-of an experiment to see if this can be done well and will no doubt go through some changes as I fine-tune the usage of pam.mount

So I searched and read but still ran into all sorts of trouble until I stumbled on the answer myself. Seems that activating and configuring pam.mount is rather simple but getting USER rather than root mounts to work is, at last as far as I can tell undocumented or incomplete on the web. Well it must be somewhere, I just couldn't find it.

The original purpose of pam.mount was to mount network shares when the user logged in so that boot wasn't hung by them and to release the network mounts when not actually needed. My purpose was slightly different - they are network mounts but I want them solely accessible by and for the user logged in and no others, and I wanted to have this happen for every user. Since each user (5 of them) would have 6 personal folders mounted (Documents, Downloads, Music, Pictures, Projects, and Videos) and 1 public folder, that's 35 mounts, and more if I added any more users. That's a lot in fstab. I didn't want to use symlinks (the easiest way to do this) I wanted bind mounts because they act more like local folders.

My boundaries for this purpose were: A little as possible in /etc/fstab, no additional sudo rules (to allow users to mount their own folders), and using NFSv4 to mount the shared folders (also means less in fstab), functionality as transparent to the end user as possible.

I also us btrfs everywhere and subvolumes are part of the setup. I will skip the mounting and creation of the folders on the server and how they're mounted.

For this how-to you need only know:

The public folders are mounted in fstab in a single NFSv4 entry at "/shared" on my desktop.
The private folders are mounted in the same way at "/mnt/private".
If I access /mnt/private directly as my user, I see five folders there - one for each user - but I cannot access them other than my own due to having permissions at 700.

My goal is to bind-mount each of the folders to my user home as I log in and unmount them when I log out.

NFSv4 allows to to export and mount a single folder and access everything under it at the same mount. This means one line in fstab and one in exports.

Activating PAM.MOUNT and getting the bind mounts working:

Getting pam.mount active was simple, the files are in /etc/pam.d
Edit "common-auth" /etc/pam.d/login and add
auth optional pam_mount.so
to the end and edit "common-session" adding
session optional pam_mount.so
to the end.
Edit /etc/pam.d/login and add

#added for pam_mount
auth required pam_mount.so
auth required pam_unix.so use_first_pass
session optional pam_mount.so
session required pam_unix.so

to the files and save.

You then need to create a file named "pam_mount.conf.xml" in /etc/security and another file of the same name that's hidden in your home.

In /etc/securitypam_mount.conf.xml, I entered this:

[FONT=monospace]<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">

<pam_mount>

<debug enable="0" />

                <!-- Volume definitions -->

                <!-- pam_mount parameters: General tunables -->

<luserconf name=".pam_mount.conf.xml" />

<mntoptions allow="*" />
<mntoptions deny="" />
<mntoptions require="" />

<logout wait="0" hup="0" term="0" kill="0" />

                <!-- pam_mount parameters: Volume-related -->

<mkmountpoint enable="1" remove="false" />

</pam_mount>
[/FONT]

This activates pam.mount and looks in the user's home folder for private mounts. If you have of things you want root to mount, you can add them here.

Then in each user's home I created .pam_mount.conf.xml and added;

[FONT=monospace][COLOR=#000000]<?xml version="1.0" encoding="utf-8" ?>[/COLOR]
<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">

<pam_mount>

<debug enable="0" />

                <!-- Volume definitions -->

<logout wait="0" hup="0" term="0" kill="0" />

                <!-- pam_mount parameters: Volume-related -->

<mkmountpoint enable="1" remove="false" />

<volume options="bind" path="/mnt/private/%(USER)/Documents/" mountpoint="/home/%(USER)/Documents/" />
<volume options="bind" path="/mnt/private/%(USER)/Downloads/" mountpoint="/home/%(USER)/Downloads/" />
<volume options="bind" path="/mnt/private/%(USER)/Music/" mountpoint="/home/%(USER)/Music/" />
<volume options="bind" path="/mnt/private/%(USER)/Pictures/" mountpoint="/home/%(USER)/Pictures/" />
<volume options="bind" path="/mnt/private/%(USER)/Projects/" mountpoint="/home/%(USER)/Projects/" />
<volume options="bind" path="/mnt/private/%(USER)/Videos/" mountpoint="/home/%(USER)/Videos/" />

</pam_mount>[/FONT]

The individual user file is the part I figured out on my own. If you put the %(USER) mounts in the main xml file, they're mounted as "root" instead of the user and then fail because root doesn't have these folders. I will probably move the private and public main mounts out of fstab and into the root pam.mount config.

There are dozens of other options when using pam.mount and I'm excited to dig a little deeper and really fine-tune this.

I also haven't fully tested this; server not on at login, server failing while logged in, etc., so more to do.

[oshunluvr]

Also of note, for some reason Dropbox will not allow you to sync to a folder mounted this way. Apparently you have to sync to a local folder. So I had to acquiesce to not having my Dropbox folder under my Downloads folder as in the past.

[oshunluvr]

I just discovered two interesting negative side effects to how I'm doing this at the moment:

1. If a user decides to make a new folder in their home, the folder will not go onto the server.
2. I have a non-standard folder - "Projects" in my home but my others users don't, so the pam_mount will generate an error and maybe delay log in (not tested).

So if I am to do this the way I'm hoping to, I will somehow need to handle these issues.

My idea is to have all the personal media folders on the server, but not the settings or configuration files. The reasoning is if I have multiple distros with different things installed or totally different versions of things, I want that part kept in the distro home, but at the same time I want the media folders (Documents, etc.) to be available everywhere. When I log into Manjaro, I don't want my KDEneon desktop setting muck about.

If I just mount all the media folders to a location, they'd be nested in an unpleasant and non-standard way.

I'm hoping I can get pam_mount to somehow detect existing folders and mount them, but somehow I must also get folders to be added to the server when they are added to the users' Home.

[GreyGeek]

After reading this thread all I can say is that I am thankful that I am retired and don't have to code any more. My brain hurts just reading about your travails.

[oshunluvr]

I edited the pam_mount.config.xml files in the first post because I found a couple errors and I changed a couple things to make it work better. I also removed the remarks to make the post more readable.

I also decided to revert the Public folders back to a symlink.

[jlittle]

...
I'm hoping I can get pam_mount to somehow detect existing folders and mount them, but somehow I must also get folders to be added to the server when they are added to the users' Home.

That sounds hard. It is possible to have a programme notified when something is added to a directory (dolphin does this) so I presume that could be a script, but whether it is feasible for that script to move a directory to the server and set up the mount I've little idea. Are the pam mounts user mounts?

Regards, John Little

[oshunluvr]

That sounds hard. It is possible to have a programme notified when something is added to a directory (dolphin does this) so I presume that could be a script, but whether it is feasible for that script to move a directory to the server and set up the mount I've little idea. Are the pam mounts user mounts?

Regards, John Little

Yeah, it seems too hard to do to me. I was sort of thinking out loud. Although it would be nice way to implement this. I've basically settled on a README for new users that would explain the folder limitations.

The mounts can be done in a per-user setting file and that's how I'm implementing this at the moment. The second code block in the first post shows the contents. I was pondering that instead of this:

<volume options="bind" path="/mnt/private/%(USER)/Documents/" mountpoint="/home/%(USER)/Documents/" />
<volume options="bind" path="/mnt/private/%(USER)/Downloads/" mountpoint="/home/%(USER)/Downloads/" />
<volume options="bind" path="/mnt/private/%(USER)/Music/" mountpoint="/home/%(USER)/Music/" />
<volume options="bind" path="/mnt/private/%(USER)/Pictures/" mountpoint="/home/%(USER)/Pictures/" />
<volume options="bind" path="/mnt/private/%(USER)/Projects/" mountpoint="/home/%(USER)/Projects/" />
<volume options="bind" path="/mnt/private/%(USER)/Videos/" mountpoint="/home/%(USER)/Videos/" />

I could have something like:

<volume options="bind" path="/mnt/private/%(USER)/$folder_name/" mountpoint="/home/%(USER)/$folder_name/" />

and loop though any and all folders each user had. pam_mount will actually create mount points when needed.

[oshunluvr]

PAM_MOUNT SETUP CHANGE:

As I said at the top, info was hard to find and often incomplete or incorrect.

I noticed that pam_mount was not unmounting when I logged out and would then re-mount when I logged in, resulting in many overlapping mounts - as in the same mount done many times.

A little more research and I discovered instead of editing /etc/pam.d/common-auth and common-session, I needed to only edit login. I have made the corrections to the original post.

[GreyGeek]

So, everything is easy once you know how!

The trick is getting to “know how”.