pam_cifscreds(8)

📦
version 7.9 · 7 versions
, in arch rolling, nixpkgs unstable, ubuntu stonking

💅 pam_cifscreds — the PAM module that handles your NTLM creds (manual page pam_cifscreds(8), straight out of the System Manager's Manual, bestie)

okay so picture this: you're logged in, you've got a multiuser cifs mount, and somebody has to hand the kernel your username + password. That somebody is pam_cifscreds. She's iconic, she's lowkey invisible, and she's about to make your login Just Work™. Let's get into it 🎀

✨ SYNOPSIS ✨

So basically you go edit the PAM config files for the systems where you want NTLM credentials registered automatically — think /etc/pam.d/login — and you tweak them like this:

...
auth       substack     system-auth
+++ auth       optional     pam_cifscreds.so
auth       include      postlogin
...

...
session    include      system-auth
+++ session    optional     pam_cifscreds.so domain=DOMAIN
session    include      postlogin
...

Then swap DOMAIN for the name of your Windows domain, or use host= instead (more on that down below 👇).

🌸 DESCRIPTION 🌸

pam_cifscreds is that PAM module that automatically adds credentials (username and password, the whole package 💖) so you can establish sessions in multiuser mounts. She's the plug.

Here's the situation she solves: when a cifs filesystem is mounted with the "multiuser" option and it is not using krb5 authentication, it still needs to get each user's credentials from somewhere. Nobody's gonna manifest them out of thin air. That's literally where pam_cifscreds comes in — she hands those credentials to the kernel automatically at login. Effortless. Main character energy fr fr.

In the session section of the PAM configuration file, the module can take either an NT domain name or a list of hostnames or addresses. iykyk 🦋

💅 OPTIONS 💅

pam_cifscreds supports a couple options which you set in the PAM configuration files. Heads up though: you must have one (and only one) of domain= or host=. Not zero, not both. One. Periodt.

  • debug — turns on some extra debug logging. Very "let me see what's going on in here" of her 👑
  • domain=<NT domain name> — credentials get added for the specified NT domain name.
  • host=<hostname or IP address>[,...] — credentials get added for the specified hostnames or IP addresses. Yes you can list multiple, separated by commas 🔥

🦋 NOTES 🦋

  • The pam_cifscreds PAM module requires a kernel built with support for the login key type. That key type was added in v3.3 in mainline Linux kernels. So like… check your kernel bestie, no cap.
  • Since pam_cifscreds adds keys to the session keyring, it is highly recommended that you use pam_keyinit to make sure a session keyring is actually established at login time. Do not skip this, she needs her setup to be right 😭
fr fr, use pam_keyinit. This is the "drink water and get 8 hours of sleep" of this man page.

🌈 SEE ALSO 🌈

💜 AUTHOR 💜

The pam_cifscreds PAM module was developed by Orion Poplawski <<orion@nwra.com>>. Legend behavior, honestly 🫶

and that's the whole page, bestie! this one's pam_cifscreds(8) from the System Manager's Manual — go forth, register those NTLM credentials, and slay ✨💅

📦 where this page comes from