0

Background: I am trying to deploy a custom backup strategy in my lab. A "trigger" script is executed periodically on the computer, fetches the most recent backup instructions for the machine from a network share (accessed via samba on the local network) and writes the resulting log files to that same shared folder. The first step in the trigger script is to mount the samba share to read/write files.

What works: Our IT department has created an active directory security group containing the machines allowed to access the shared folder. Windows machines as well as MacOS machines are listed in the group members. On Windows, the "System" account can connect to the shared folder to read & write files without the need to provide any credentials. Mounting is not necessary as we can read files from \serverip\share On MacOS, I can mount the shared folder using mount_smbfs if I provide the credentials of an authorized user.

The issue: On MacOS, I am unable to mount without supplying user credentials. Mounting the shared folder with mount_smbfs fails with: "server rejected the connection: authentication error". mount_smbfs appears to expect authorized credentials, while I hope to mount without passing credentials, using the AD security group. I am running the commands as root.

What I have checked:

  • Computers are joined to the domain
  • Hostnames match the object names in Active Directory
  • Using the hostname or domain\hostname as username for the share does not work
  • Using -N option to avoid password prompt does not solve the issue

I have no control on the samba shares, they are handled by our IT department only.

Is there some obvious information/configuration I am missing to mount a share as root without credentials on macOS?

2
  • Can your IT department create a "Mac_Backup" user in AD and then you can add that same user on the Macs as an admin? I may be missing something here as it's been a while... Commented Apr 20 at 13:11
  • This would indeed be the next best solution, as discussed with our IT department. Without even adding a MacOS user, the script (here executed by root) could just use the appropriate credentials to temporarily mount the share, run the backup, and unmount the share. However, the goal here is to use the machine authentification and the AD security group for our Windows and MacOS machines to be managed in the same way.
    – Gaetan
    Commented Apr 22 at 9:55

1 Answer 1

1

After some more research, I discovered that MacOS stores the Active Directory computer id and password in the system keychains (see source below). This was helpful in solving my problem, so here is the full answer:

RETRIEVE ACTIVE DIRECTORY COMPUTER ACCOUNT AND PASSWORD

The password and computer account can be retrieved from the terminal using the security find-generic-password command. It appears sudo is needed to get the password, but not the account.

As an example, for a Mac named COMPUTER01 and bound to the domain DOMAIN : security find-generic-password –sw "/Active Directory/DOMAIN" /Library/Keychains/System.keychain will return the human-readable form of the password.

security find-generic-password -s "/Active Directory/DOMAIN" /Library/Keychains/System.keychain | grep -m 1 "acct" | sed -e 's/"acct"<blob>\="//' -e 's/"//' | tr -d ' ' will return the computer account (in this case computer01$, note the trailing $)

Alternatively, using the Keychains utility, one can also browse to the system section and reveal the account and password using the graphical interface.

MOUNT A SAMBA SHARE USING THE COMPUTER AUTHENTICATION

Prequisite: your computer should be allowed access to the share in the Active Directory - in my case using a security group.

  1. Retrieve the Active Directory computer account and password as described above
  2. If necessary, create the mountpoint /path/to/mountpoint
  3. Use mount -t smbfs //$account:$password@share /path/to/mountpoint to mount the share. Importantly, $account and $password should be url encoded to prevent special characters from being interpreted.
  4. When done, use diskutil unmount /path/to/mountpoint to unmount the share

Link to the source: https://chrisbrown.au/techblog/how-to-retrieve-mac-os-x-10-8-active-directory-computer-account-password/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .