Connecting Linux machine to windows AD and mounting remote user dirs automagically ‒ how?

Dear lazy web,

I've been working for the last year as an informatics teacher at high school and I'm playing with the idea of trying to migrate a couple of machines (mine for the start, I still need to connect to remote win desktop for certain tasks :-D) fully to Linux which would work as well as the windows machines WRT network shares which are on a windows AD server that I don't have admin access to. There are couple of problems, some of which I was able to solve, some of which I have an idea how to solve and some of which I don't now at all how to solve, any pointers appreciated! I'm testing this on Fedora 20 by the way.

Joining the domain

This one took me a lot time to solve and I had a couple of times when I gave up. Mostly because I didn't know the AD server hostname and even when I found it, I still couldn't get it to work via the system-config-authentication, nor the config files in /etc. By chance I was lucky to run across a QA test case for joining the AD domain! Well, and that worked like a charm. So the trick is to run:

$ realm join --user=User ad.example.com

Logging in

Kinda superfluous for me, but a real need when there would be more users to use the computer. That was what I was originally trying to achieve. After joining the domain with the above example, it started to work magically. I don't remember if there was anything else that I needed to set up, probably not. But you definitely need oddjob-mkhomedir that sets up the environment when a new user (unknown to the local computer) logs in for the first time. I believe it should be installed automagically during the join. I've tried it in CLI and in LightDM, both worked by the time I successfully joined.

Mounting remote locations

Well, this is the last thing I was able to do. It does not require logging in, it does require joining the domain. You must fill your login credentials, though, if you don't have a guest share. I've run across a bug in gvfs-samba ‒ when I'm copying multiple files over the network, it hangs. So for the network shares I'm using Dolphin at the moment. The GUI managers I've tried work both in the same way, just go to the location bar, type smb://username@domain/share, you're asked for a password, then it mounts and you can use it. In Thunar, which uses gvfs, you need gvfs-samba package. You can also mount it in CLI:

gvfs-mount smb://username@domain/share

On my old notebook which was essentially multiple times upgraded old fedoras this also created a mount point in the filesystem (somewhere under /run/user/gvfs), in my new computer (which has fresh Fedora 20), this does not create a mount point in the filesystem. Quick search on the internet showed, I need gvfs-fuse package and its daemon running. Then it appears under /run/user/⟨uid⟩/gvfs/* which then can be easily symlinked for wine to appear as a drive if needed.

Mounting the shared network shares on login

Now, here's where I have vague idea that I could probably call something like gvfs-mount on login, the problem is that it needs password. Is there a way to pass the credentials from login credentials to the mount data? Or ask for them only for the first time and in gui (meaning the mount point is created automatically, the user is asked for login credentials which are then saved in his default keyring)? The path to network share should be same for all users.

Mounting user specific network shares on login

Now, the same as above, but the network path depends on the user, i.e. something like smb://username@domain/share/username.

Doing the above two for new users as well

How do I run a custom script when a local user is created during first remote login?

"Mounting" the network shares as drives in wine

Now, here I have an idea that some simple symlinking should do the trick, the network shares names should stay the same (even the directories they appear in the filesystem), so it shouldn't be a problem.

So, once again, any help, pointers, suggestions are very welcome, I'll try to keep this post updated with new information and new solutions.

UPDATE: Solution to user automount problem

So, with the help of people that commented in the comments section, I found a solution that's called pam_mount. I'm not sure how to do it the right way (TM), but here's what made it work for me:

• Add auth optional pam_mount.so before auth sufficient pam_winbind.so cached use_first_pass, so that the credentials are shared between pam mount and login to AD. I added it to /etc/pam.d/system-auth, I'm not sure that's the correct way though.
• Add session optional pam_mount.so so that pam_mount is executed at the start of the session. I added it to the end of the same file as above.
• Edit /etc/security/pam_mount.conf.xml. Typical line would look like <volume user="*" sgrp="DOMAIN\domain users" fstype="cifs" server="domain.server.org" path="Shares/Usr_home/%(DOMAIN_USER)" mountpoint="/home/DOMAIN/%(DOMAIN_USER)/.ad/%(DOMAIN_USER)" />

And voila, it works. I only have one still unsolved issue with this, and that's I cannot get it not to use forceuid, forcegid and nounix mount options. I haven't tried yet, if it's a problem with pam_mount, or mount.cifs (i. e. if the server/client combination support cifs unix extensions like POSIX acls)...

Why I don't like new UIs

I've recently had two experiences with UIs that are designed to be streamlined and user-friendly. And, frankly, to me they're anything but that.

Windows 8

For some reason I had to use it and well, it took me several minutes to figure out that the loading...-like screen is actually a log in screen and I need to click a nearly invisible single-coloured button to actually allow me to select (or write) a username and log in. Then it took me another several minutes to figure out how to find Desktop. During my work I was several times greeted with IE instead of Start menu (who the hell did have the idea to put an IE icon next to a sensitive corner that gets you to the start menuscreen?) and found out how to log out by sheer luck. Didn't figure how to shut down from logged user. Ugh, I have to tell, GNOME Shell is heaven compared to that.

Fedora 20 Installation

Everything is parallel. I have to say, I prefer the linearity of the old Anaconda. Just clicking next, next, next and nothing gets missed... Now, well, that's another question. The icons being single coloured didn't help much either. I just hate these new symbolic icons that the PC world of nowadays is plagued with. E. g. here on blogger I always confuse pencil with label. *Sigh*

But well, having to spend 30 mins on custom partitioning and only figuring the problem after reading a manual, when it was actually a something the installed could have told me itself, is a completely another story :( Why does the new anaconda tells me the partition is not correct, but does not tell me why. Why? Why? If it knows it's not correct, it should tell me the reason, not just pop up a bubble telling me something is wrong, that Fedora needs 5 Gigs of space (which was perfectly satisfied by the configured layout) but not telling me, that the problem is missing /boot/efi partition?! Something that's was obvious to the installer but not to the human encountering UEFI for the first time... Why it cannot tell me the error it encounters? Why? Why are all the new UIs pretending human is a brain-dead idiot with less intelligence than a well-trained monkey?

But to end it on positive note, F20 on Live USB is freakishly fast as well as the actual installation :-p

Who the heck are modern desktops for?

This question has been bugging me for a while since GNOME 3. Nowadays in advanced countries, computer education is part of regular school curriculum. Children are taught what is CPU, what is graphics card, what is memory, how to turn on/off computer, how to behave on the net, how to use word processor, tabular calculator, presentation maker, sometimes even databases or easy programming. Unless in really rich school they are taught usually on something like Windows XP, they know the classical desktop. And they are confused by interfaces like Windows 7 and Gnome shell.

I am 24, my first desktop was Windows 3.11 (at school), then I grow up on Windows 95/98/2000 and Windows XP after finally switched to linux. I'm not that old to not be able to adapt, yet after years spent with linux I find the old Windows ineffective (just find something it the long non-categorized menu of theirs or try to run a few apps at once) and just recently I had to navigate Windows 7 with a touchpad. Let me tell you, it was a major pain in the ass. In my family everyone except me now uses Windows 7 on regular basis and they always complain about it. I haven't heard them ever complain about user interface when in Win XP or Gnome 2.

So why do the heck do we need the change that makes an assumption that presenting user with huge icons of every app installed instead of neat two-level categorized menu is more easy to use (it does not take a very bright person to tell that Movie Player would be categorized under Sound&Video)? Why do we need a change that makes an assumption that customization is a bad thing (I believe that different people have different needs and customizing a desktop to certain level can make it more effective to use for them)? Why do we need a change that effectively tells you that having more terminal windows open at once is a bad thing (yes, even though most common terminal emulators have tabs, I still find it more effective in certain cases to have three or four windows of terminal opened at once and nicely tilted on the desktop)? Why do we need a change that hides your favourite apps when not in "Activities" overview?

Who the heck is the modern desktop designed for? Honestly saying, not for me and not for anyone I know personally either.