20.4 CIFS Client Configuration

     

We use a cookbook approach as we did for a CIFS Server. The setup of a CIFS client is similarly straightforward:

1. Install the CIFS/9000 Client product.
   
   
2. Configure /etc/opt/cifsclient/ cifsclient .cfg .
   
   
3. Run the CIFS client startup script.
   
   
4. Create a mount point directory.
   
   
5. Add the CIFS filesystems to the /etc/fstab file.
   
   
6. Mount the CIFS filesystems.
   
   
7. Execute the /opt/cifsclient/bin/cifslogin program.
   
   
8. Verify that your cifslogin succeeded.
   
   

Let's look at each step more closely.

20.4.1 Install the CIFS/9000 Client product

Remember that this swinstall will require a reboot, because the kernel needs to be able to recognize CIFS as a filesystem type. The client bundle may already be installed as part of the basic HP-UX 11i Operating Environment. I have downloaded the most recent version of the client software from http://software.hp.com to use in this demonstration.

 root@hpeos004[]  swlist -l fileset -a is_reboot -s /tmp/B8724AA_A.01.09_HP-UX_B.11.11_32+64  .depot  # Initializing... # Contacting target "hpeos004"... # # Target:  hpeos004:/tmp/B8724AA_A.01.09_HP-UX_B.11.11_32+64.depot # # CIFS-Client   CIFS-Client.CIFSCLIENT-KRN    true   CIFS-Client.CIFSCLIENT-KRN    true   CIFS-Client.CIFSCLIENT-MIS    false   CIFS-Client.CIFSCLIENT-RUN    false # PAM-NTLM   PAM-NTLM.PAM-NTLM-RUN         false   PAM-NTLM.SMB-LIB-RUN          false root@hpeos004[] 

Once it's installed, we can proceed.

20.4.2 Configure /etc/opt/cifsclient/cifsclient.cfg

There are few configuration changes to be made in this file. The only change I had to make for this demonstration was to edit the line defining my Windows domain/workgroup:

 root@hpeos004[]  vi /etc/opt/cifsclient/cifsclient.cfg  # Storing user passwords and mounts in the database can be disabled by # setting the following variable to "no". This may be useful for sites # where the client users can not be trusted to understand the security # implications. If the variable is not defined, it defaults to "yes". allowSaving = no;     domain = "  UKDOM1  "    // domain name sent to server 

20.4.3 Run the CIFS client start script

There is a command /opt/cifsclient/bin/cifsclient that we can run to start the daemon process /opt/cifsclient/sbin/cifsclientd . The more normal startup method is to configure the file /etc/rc.config.d/cifsclient to ensure that the daemon starts after reboot.

 root@hpeos004[]  vi /etc/rc.config.d/cifsclient  ... RUN_CIFSCLIENT=1 

I will use the startup script to start the daemon:

 root@hpeos004[]  /sbin/init.d/cifsclient start  CIFS Client started; process id: 2943 root@hpeos004[] 

We can use the cifsclient command to get the status of the daemon:

 root@hpeos004[]  /opt/cifsclient/bin/cifsclient status  path:     /opt/cifsclient/sbin/cifsclientd version:  FILESET HP CIFS CLIENT: Version: A.01.09           Compiled on HP-UX B.11.00, s800/R390, 03/06/24 12:01:20           cifsclientd: ver_id=3050182349 cksum:    2189923982 status:   The CIFS Client is up; process id 2943, started 10:56:56. mntck:    ok root@hpeos004[] 

20.4.4 Create a mount point directory

This makes sense, because we are just about to mount a filesystem. Obviously, we will create the requisite number of mount points for all the CIFS mounts we will perform.

 root@hpeos004[]  mkdir /W2K.data  

20.4.5 Add the CIFS filesystems to the /etc/fstab file

If you are going to have the CIFS filesystems available after every reboot, then it makes sense to add an entry to /etc/fstab . As you can see, the format of an entry for a CIFS filesystem is very similar to an entry for an NFS filesystem; the only difference is that the filesystem type is now cifs :

 root@hpeos004[]  vi /etc/fstab  ...  ckpc2:/work /W2K.data cifs defaults 0 0  

Like any other mount command, we need to ensure basic TCP/IP functionality; ping and hostname lookup works.

 root@hpeos004[]  ping ckpc2 64 5  PING ckpc2.mshome.net: 64 byte packets 64 bytes from 192.168.0.1: icmp_seq=0. time=0. ms 64 bytes from 192.168.0.1: icmp_seq=1. time=0. ms 64 bytes from 192.168.0.1: icmp_seq=2. time=0. ms 64 bytes from 192.168.0.1: icmp_seq=3. time=0. ms 64 bytes from 192.168.0.1: icmp_seq=4. time=0. ms ----ckpc2.mshome.net PING Statistics---- 5 packets transmitted, 5 packets received, 0% packet loss round-trip (ms)  min/avg/max = 0/0/0 root@hpeos004[] 

20.4.6 Mount the CIFS filesystems

As you can see, we treat CIFS filesystems like any other. Consequently, it will be of no great surprise that the mount command is little different. We can mount individual CIFS filesystems:

 root@hpeos004[]  mount -F cifs ckpc2:/work /W2K.data  

or we can mount all the CIFS filesystems listed in /etc/fstab :

 root@hpeos004[]  mount -aF cifs  

The surprising thing is that when we use commands like bdf , we get an I/O error even though there is an entry in our mount table. It's not until we actually use the filesystem that we are given access to it (first, we will need to be authenticated by the CIFS server; that comes next ).

 root@hpeos004[]  cat /etc/mnttab  /dev/vg00/lvol3 / vxfs log 0 1 1063014366 /dev/vg00/lvol1 /stand hfs defaults 0 0 1063014366 /dev/vg00/lvol8 /var vxfs delaylog 0 0 1063014369 /dev/vg00/lvol7 /usr vxfs delaylog 0 0 1063014369 /dev/vg00/lvol4 /tmp vxfs delaylog 0 0 1063014369 /dev/vg00/lvol6 /opt vxfs delaylog 0 0 1063014370 /dev/vg00/lvol5 /home vxfs delaylog 0 0 1063014370 hpeos004:(pid664) /net ignore ro,intr,port=839,map=-hosts,indirect,dev=0000 0 0 1063014434 ckpc2:/work /W2K.data cifs soft,noac,retrans=3,timeo=200,acregmin=0,acregmax=0,acdirmin=0  ,acdirmax=0,NFSv3 0 0 1063015373 root@hpeos004[]  bdf  Filesystem          kbytes    used   avail %used Mounted on /dev/vg00/lvol3    1302528 1051483  235369   82% / /dev/vg00/lvol1     111637   49319   51154   49% /stand /dev/vg00/lvol8     516096   51598  435565   11% /var /dev/vg00/lvol7     917504  753622  153675   83% /usr /dev/vg00/lvol4      65536    2237   59347    4% /tmp /dev/vg00/lvol6     851968  649867  189695   77% /opt /dev/vg00/lvol5      24576    1390   21740    6% /home NFS access failed for server ckpc2: RPC: Remote system error NFS fsstat failed for server ckpc2: RPC: Remote system error bdf: /W2K.data: I/O error root@hpeos004[] 

This is where CIFS and NFS have a fundamental difference; CIFS grants access on a user-by-user basis. We will need to be authenticated by the CIFS server before we can use the share.

20.4.7 Execute the /opt/cifsclient/bin/cifslogin program

Access to individual CIFS shares is on a user-by-user basis. Even though we have added entries to the /etc/fstab file, we will not see mounted filesystems until a user (CIFS client) is authenticated by the CIFS server. Obviously, we need to have a valid username and password configured on the CIFS server. If the CIFS server is an HP-UX machine, it is a good idea that UIDs on both machines are kept consistent so that file access permissions and ownerships work in a consistent manner.

 root@hpeos004[]  /opt/cifsclient/bin/cifslogin ckpc2 charlesk  Remote user charlesk's password: 

20.4.8 Verify that your cifslogin succeeded

Now that we are authenticated, we can see and use the shares we have access to:

 root@hpeos004[]  bdf  Filesystem          kbytes    used   avail %used Mounted on /dev/vg00/lvol3    1302528 1051455  235395   82% / /dev/vg00/lvol1     111637   49319   51154   49% /stand /dev/vg00/lvol8     516096   51590  435573   11% /var /dev/vg00/lvol7     917504  753622  153675   83% /usr /dev/vg00/lvol4      65536    2237   59347    4% /tmp /dev/vg00/lvol6     851968  649867  189695   77% /opt /dev/vg00/lvol5      24576    1390   21740    6% /home ckpc2:/work        39029912 27675024 11354888   71% /W2K.data root@hpeos004[W2K.data]  cd /W2K.data  root@hpeos004[W2K.data]  ls  ACCESS                 Java                   Video AutoSketch             Netscape               Word Education              OU                     courses FromHP                 OfficeJetG95-Software  free HP-Book                Perl                   progs HP-NetAccess           PowerPoint             route.print HPUX-tools             Reflection             tmp Images                 Rescued document.txt root@hpeos004[W2K.data] 

There's also a command cifslist , which will show us the shares we have access to. I would like to use the command before we run cifslogin , but it doesn't work that way; you have to be authenticated before you can see what you have access to:

 root@hpeos004[W2K.data]  /opt/cifsclient/bin/cifslist -A  ======================================================================== server ckpc2: ======================================================================== Remote Username: charlesk             Local Username: root Share: \CKPC2\WORK         rw /W2K.data root@hpeos004[W2K.data] 

This is effectively the same as a net view \\ckpc2 command that you could execute from a Windows-based machine.

Once a user is finished with a share, he can issue a cifslogout command to end his CIFS session. If not, the share will remain mounted. You may want to think about issuing a trap from within a user's .profile to issue a cifslogout when he exits from his UNIX session.

 root@hpeos004[W2K.data]  cd  root@hpeos004[]  /opt/cifsclient/bin/cifslogout ckpc2  root@hpeos004[]  bdf  Filesystem          kbytes    used   avail %used Mounted on /dev/vg00/lvol3    1302528 1051455  235395   82% / /dev/vg00/lvol1     111637   49319   51154   49% /stand /dev/vg00/lvol8     516096   51590  435573   11% /var /dev/vg00/lvol7     917504  753622  153675   83% /usr /dev/vg00/lvol4      65536    2237   59347    4% /tmp /dev/vg00/lvol6     851968  649867  189695   77% /opt /dev/vg00/lvol5      24576    1390   21740    6% /home NFS fsstat failed for server ckpc2: RPC: Remote system error bdf: /W2K.data: I/O error root@hpeos004[] 

At this point, a user can reuse the CIFS share simply by running cifslogin . If we are completely finished with this share, we will probably want to umount the share to avoid the I/O errors from bdf . We can simply use the familiar umount command, as we would do with any other mount point. Alternately, root can use the option force_umount to the cifsclient command, although we need to shut down the CIFS client daemon (this command is normally used only if a normal umount fails) :

 root@hpeos004[]  /opt/cifsclient/bin/cifsclient force_umount /W2K.data  The 'force_umount' command cannot be used when the CIFS Client is running. root@hpeos004[]  umount /W2K.data  root@hpeos004[]  bdf  Filesystem          kbytes    used   avail %used Mounted on /dev/vg00/lvol3    1302528 1051455  235395   82% / /dev/vg00/lvol1     111637   49319   51154   49% /stand /dev/vg00/lvol8     516096   51574  435588   11% /var /dev/vg00/lvol7     917504  753622  153675   83% /usr /dev/vg00/lvol4      65536    2237   59347    4% /tmp /dev/vg00/lvol6     851968  649867  189695   77% /opt /dev/vg00/lvol5      24576    1390   21740    6% /home root@hpeos004[] 

20.4.8.1 AN ALTERNATIVE TO CIFSLOGIN

There is an alternative to using /etc/fstab and cifslogin ; the command I am thinking of is cifsmount . With cifsmount , we can supply all parameters necessary to log in and mount the required filesystem:

 root@hpeos004[]  /opt/cifsclient/bin/cifsmount //ckpc2/work /W2K.data -U charlesk -P banana11  root@hpeos004[]  bdf  Filesystem          kbytes    used   avail %used Mounted on /dev/vg00/lvol3    1302528 1051515  235339   82% / /dev/vg00/lvol1     111637   49319   51154   49% /stand /dev/vg00/lvol8     516096   51576  435585   11% /var /dev/vg00/lvol7     917504  753622  153675   83% /usr /dev/vg00/lvol4      65536    2237   59347    4% /tmp /dev/vg00/lvol6     851968  649867  189695   77% /opt /dev/vg00/lvol5      24576    1390   21740    6% /home localhost:\CKPC2\WORK                    39029912 27677896 11352016   71% /W2K.data root@hpeos004[] 

This command and its sister command cifsumount are commonly seen in scripts used for batch job operations via cron , and so on.

IMPORTANT

We are supplying a plain-text password on the command line here. This could be seen in the output from a ps command. An alternative is to use the “S option that will read the password from STDIN . Be aware also of the option “s that stores the hash value of a password in the CIFS client user database (/var/opt/cifslcient/cifsclient.udb ). Although the plain-text password is not stored, the hash value is functionally equivalent, meaning that someone with access to the cifsclient.udb file may be able to gain unauthorized access to a user account on a CIFS server if someone knows the format of this binary file:

 root@hpeos004[cifsclient] pwd /var/opt/cifsclient root@hpeos004[cifsclient] ll total 4 srw-rw-rw-   1 root       root           0 Sep  8 10:56  .cifsclient.sock -rw-rw-rw-   1 root       sys              5 Sep  8 10:56  cifsclient.pid -rw-------   1 root       sys            218 Sep  8 11:32  cifsclient.udb drwxr-xr-x   2 root       root            96 Sep  8 10:41 core drwxr-xr-x   2 root       root            96 Sep  8 10:56 debug drwxrwxrwx   2 root       root            96 Sep  8 10:41 krb5_tmp drwxr-xr-x   2 root       root            96 Sep  8 10:41 pam root@hpeos004[cifsclient] file cifsclient.udb cifsclient.udb: data root@hpeos004[cifsclient] more cifsclient.udb ^A^L4^AM-^GM- M-F^U^B^L^NM-Fl5fsEv@M-/M--^B^CI@M-SLM-B^XlM-^Y8 M-^M^NUM-&M-,,-M-IkU-M-^P^AM-"^\M-^?  ,`M-!nM-^]L^Rcharlesk^Fckpc2^Eroot ^DYM-^?M-^?M-^?M-^?^T/W2K.data^Z\ckpc2\work^Fckpc2^Eroot root@hpeos004[cifsclient]