pam_mount에 비밀번호가 필요한 이유는 무엇입니까?

이 도구를 사용하여 pam-auth-update일부 pam 프로필을 활성화합니다.

 PAM configuration 
 PAM profiles to enable:
    [*] encfs encrypted home directories           
    [*] Unix authentication                             
    [*] Mount volumes for user                         
    [*] GNOME Keyring Daemon - Login keyring management  
    [*] ConsoleKit Session Management

모든 것이 예상대로 작동하지만 한 가지 - 옵션이 명령에 Mount volumes for user영향을 미치는 것 같습니다 .su

/etc/security/pam_mount.conf.xml파일 에 다음 줄을 추가했습니다 .

<volume user="morfik" fstype="fuse" path="encfs#/media/Server/Dropbox.encfs/Dropbox/encrypted" mountpoint="/media/Server/Dropbox" />

루트로 터미널에 입력하면 su morfik비밀번호 프롬프트가 표시되어서는 안 되지만 대신 다음과 같은 내용이 표시됩니다.

# su morfik
reenter password for pam_mount:

위 메뉴에서 옵션을 선택 취소하면 Mount volumes for user모든 것이 보관되어 reenter password사라진 것 같습니다. 파일을 사용해 보았지만 /etc/pam.d/PAM에 대한 경험이 없어서 제대로 작동하지 못했습니다.

이 파일에서 무엇을 변경해야 하는지 아는 사람이 있나요?

업데이트 #1

디렉토리의 내용은 다음과 같습니다 /etc/pam.d.

# ls -al /etc/pam.d/
total 104K
drwxr-xr-x   2 root root 4.0K Mar 21 16:21 ./
drwxr-xr-x 153 root root  12K Mar 21 16:11 ../
-rw-r--r--   1 root root  197 Sep  8  2013 atd
-rw-r--r--   1 root root  384 May 25  2012 chfn
-rw-r--r--   1 root root   92 May 25  2012 chpasswd
-rw-r--r--   1 root root  581 May 25  2012 chsh
-rw-r--r--   1 root root 1.2K Mar 20 17:35 common-account
-rw-r--r--   1 root root 1.3K Mar 20 17:35 common-auth
-rw-r--r--   1 root root 1.5K Mar 20 17:35 common-password
-rw-r--r--   1 root root 1.3K Mar 20 17:35 common-session
-rw-r--r--   1 root root 1.2K Mar 20 17:35 common-session-noninteractive
-rw-r--r--   1 root root  527 Jul  3  2012 cron
-rw-r--r--   1 root root   69 Jul 16  2013 cups-daemon
-rw-r--r--   1 root root 4.8K Mar  5 10:18 login
-rw-r--r--   1 root root   92 May 25  2012 newusers
-rw-r--r--   1 root root  520 Jul 22  2008 other
-rw-r--r--   1 root root  147 Feb 13 07:15 passwd
-rw-r--r--   1 root root  255 Oct 15 18:40 polkit-1
-rw-r--r--   1 root root   84 Dec 27 12:40 samba
-rw-r--r--   1 root root 2.1K Feb 15 03:11 sshd
-rw-r--r--   1 root root 2.3K May 25  2012 su
-rw-r--r--   1 root root   95 Jan 15 22:58 sudo
-rw-r--r--   1 root root  108 Oct 19 23:42 xscreensaver

/etc/pam.d/system-auth파일 없음

pam_mount파일 내용을 확인해 보니 다음과 같습니다.

# egrep -i pam_mount *
common-auth:auth        optional        pam_mount.so
common-session:session  optional        pam_mount.so

문서 내용:

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.).  The default is to use the
# traditional Unix authentication mechanisms.
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.

# here are the per-package modules (the "Primary" block)
auth    sufficient              pam_encfs.so 
auth    [success=1 default=ignore]  pam_unix.so nullok_secure try_first_pass
# here's the fallback if no module succeeds
auth    requisite           pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth    required            pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth    optional    pam_mount.so 
# end of pam-auth-update config

그리고:

#
# /etc/pam.d/common-session - session-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define tasks to be performed
# at the start and end of sessions of *any* kind (both interactive and
# non-interactive).
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.

# here are the per-package modules (the "Primary" block)
session [default=1]         pam_permit.so
# here's the fallback if no module succeeds
session requisite           pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
session required            pam_permit.so
# and here are more per-package modules (the "Additional" block)
session required    pam_unix.so 
session optional    pam_mount.so 
session optional            pam_ck_connector.so nox11
# end of pam-auth-update config

업데이트 #2

테스트용으로 데비안을 사용하고 있습니다. 위치를 바꿔보았지만 pam_mount항상 똑같네요. 설명서의 일부를 읽었는데 다음과 같은 내용이 있습니다.

 When "sufficient" is used in the second column, you must make sure that
   pam_mount is added before this entry. Otherwise pam_mount will not  get
   executed  should  a  previous  PAM module succeed. Also be aware of the
   "include" statements. These make PAM look into the specified  file.  If
   there is a "sufficient" statement, then the pam_mount entry must either
   be in the included file before the "sufficient" statement or before the
   "include" statement.

이것이 어떤 변화를 가져오는지 확인하기 위해 파일에 뭔가를 추가하기도 했지만 그것은 중요하지 않습니다 pam_mount. 처음에 그들이 말하는 것처럼 시스템에 로그인할 때 비밀번호 프롬프트 대신 시스템이 계속해서 비밀번호를 묻는 /etc/pam.d/su경우pam_mountpam_mount passwordsu morfik