Pam_mount per user not working, whereas global config is fine

Support and Help
1

Hi all!!
I have problem creating cifs shares with pam_mount, where definition is stored in user home directory…

Ubuntu Version:
Example: 24.04 LTS

Desktop Environment (if applicable):
GNOME

Problem Description

My ubuntu computer is registered in active directory and I manage to login with an AD user. Now I would like to automount cifs shares.

If I define the volume in the global pam_mount conf file (/etc/security/pam_mount.conf.xml), the share is mounting on user login.

But if I allow per user conf (uncomment the following line in /etc/security/pam_mount.conf.xml)

<luserconf name=".pam_mount.conf.xml" />

and create .pam_mount.conf.xml file with volume definition in it, in ~/.pam_mount.conf.xml of an AD user : the mount is not created

Volume defined in /etc/security/pam_mount.conf.xml (working)

<volume 
 fstype=“cifs” 
 server=“my_server.fr” 
 path=“user/home/%(USER)”
 mountpoint=“/home/%(USER)/mount/P”
 options=“username=%(USER),uid=%(USER),dir_mode=0777,file_mode=0666,iocharset=utf8”    
  <and>
            <not><user>gdm</user></not>
            <not><user>root</user></not>
            <not><user>admininrae</user></not>
    </and>
</volume>

Volume defined in ~/.pam_mount.conf.xml (not working)

<volume 
        fstype="cifs" 
        server="my_server.fr
        path="user/home/%(USER)"
        mountpoint="/home/%(USER)/mount/P2"
        options="username=%(USER),uid=%(USER),dir_mode=0777,file_mode=0666,iocharset=utf8"
/>

Screenshots or Error Messages:
in the following log (auth.log), we can see the ~/.pam_mount.conf.xml is “detected”, but not applied (only the global mount is created)

2026-03-19T14:28:38.254118+01:00 31-1426-85DDIPL gdm-password]: pam_sss(gdm-password:auth): authentication success; logname= uid=0 euid=0 tty=/dev/tty1 ruser= rhost= user=userAD
2026-03-19T14:28:38.255857+01:00 31-1426-85DDIPL gdm-password]: (rdconf1.c:779): path to luserconf set to /home/userAD/.pam_mount.conf.xml
2026-03-19T14:28:38.257471+01:00 31-1426-85DDIPL gdm-password]: (pam_mount.c:365): pam_mount 2.20: entering auth stage
2026-03-19T14:28:38.308738+01:00 31-1426-85DDIPL gdm-password]: gkr-pam: unable to locate daemon control file
2026-03-19T14:28:38.308923+01:00 31-1426-85DDIPL gdm-password]: gkr-pam: stashed password to try later in open session
2026-03-19T14:28:38.379510+01:00 31-1426-85DDIPL accounts-daemon: request by system-bus-name::1.104 [gdm-session-worker [pam/gdm-password] pid:2405 uid:0]: cache user ‘userAD’
2026-03-19T14:28:38.399177+01:00 31-1426-85DDIPL gdm-password]: pam_unix(gdm-password:session): session opened for user userAD(uid=9377) by userAD(uid=0)
2026-03-19T14:28:38.416619+01:00 31-1426-85DDIPL gdm-password]: (rdconf1.c:779): path to luserconf set to /home/userAD/.pam_mount.conf.xml
2026-03-19T14:28:38.417901+01:00 31-1426-85DDIPL gdm-password]: (pam_mount.c:568): pam_mount 2.20: entering session stage
2026-03-19T14:28:38.419840+01:00 31-1426-85DDIPL gdm-password]: (mount.c:264): Mount info: globalconf, user=userAD

What I’ve Tried:

  • change permissions on ~/.pam_mount.conf.xml
  • reboots after each modification
  • remove volume definition from global config

Thank you for your help

Gérald

2

I might be wrong but it looks like you might be missing a “ on the server=”my_server.fr ← here.

3

sorry, it seems I removed the quote while renaming the server in my message…In my conf, the quote is present…any idea how to debug that problem?
thank you

4

solution found using login to ly AD user from a local user : the errors were explicit (and debug enabled).
The problem came from the options
nodev, nosuid were missing (I didn’t check what they are for) and I had to remove all the options i have set
the working conf is :

<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">

<pam_mount>
<volume 
        fstype="cifs" 
        server="my_server.fr"
        path="user/home/%(USER)"
        mountpoint="/home/%(USER)/mount/P2"
        options="nodev,nosuid"
/>
</pam_mount>

this file must be owned by the AD user!

5

This topic was automatically closed 18 hours after the last reply. New replies are no longer allowed.