Mount CIFS shares as non-root on RHEL7 w/o desktop

Question

We have a Windows (AD) domain which a RHEL/CentOS 7 server has joined (SSSD / realmd). The users log into the server via SSH with their AD credentials. Now the users should be able to mount some of their Windows shares on the RHEL server. However, I want to avoid granting all the users sudo rights for (u)mount and setting the SUID flag for (u)mount.

I have discovered the gvfs-mount command which seems to be what I need, so I went ahead and installed the necessary packages. As the application needs to have access to a session DBus, the variable DBUS_SESSION_BUS_ADDRESS needs to be exported. To be able to start a DBus-Daemon (dbus-launch), I installed the dbus-x11 package.

Running the commands

export $(dbus-launch)
gvfs-mount smb://DOMAIN\;USER@HOST/SHARE

mounts the share successfully.

My initial thought was to just put the first line into the .bash_profile. There are, however, two major problems related to that solution:

1. Every time someone logs in, a new instance of dbus-daemon is created that is not killed upon logout. Even worse, the package dbus-x11 installed the script /etc/X11/xinit/xinit.rc.d/00-start-message-bus.sh that starts already an instance per login, but how do I get the address variable?
2. If the user forgets to unmount the share, it can't be unmounted at a later login as the address variable is unknown.

Ideally, the dbus-daemon should be started upon login and the address variable should be exported. When the SSH session is terminated (logout is optional) all shares that are still mounted should be unmounted and the daemon should be killed. How do I achieve this in an elegant way?

Related, but old and essentially not answered: Reuse D-Bus sessions across login sessions

Answer 1

Instead of using gvfs-mount, which is really intended for working within a graphical login, I've successfully done this using autofs.

I just have an autofs config file in /etc/auto.master.d/ called winhome.autofs (it has to end with .autofs), and it looks something like this:

/winhome -fstype=cifs,sec=krb5,uid=&,user=&,cruid=& ://sharename/&

As long as you have sssd set up to get you a kerberos ticket, it will use that ticket to automatically mount the volume \sharename\username when the user opens that directory (either using a graphical app or through the shell).