Automount Maps
Manage automount maps and keys for automatic filesystem mounting in NFS environments. Automount configuration enables centralized management of mount points, indirect and direct maps, and supports standard automounter syntax. Features include map and key lifecycle management, location-based map organization, and import/export capabilities for migration and backup.
Stores automount(8) configuration for autofs(8) in IPA.
The base of an automount configuration is the configuration file auto.master. This is also the base location in IPA. Multiple auto.master configurations can be stored in separate locations. A location is implementation-specific with the default being a location named ‘default’. For example, you can have locations by geographic region, by floor, by type, etc.
Automount has three basic object types: locations, maps and keys.
A location defines a set of maps anchored in auto.master. This allows you to store multiple automount configurations. A location in itself isn’t very interesting, it is just a point to start a new automount map.
A map is roughly equivalent to a discrete automount file and provides storage for keys.
A key is a mount point associated with a map.
When a new location is created, two maps are automatically created for it: auto.master and auto.direct. auto.master is the root map for all automount maps for the location. auto.direct is the default map for direct mounts and is mounted on /-.
An automount map may contain a submount key. This key defines a mount
location within the map that references another map. This can be done
either using automountmap-add-indirect —parentmap or manually with
automountkey-add and setting info to “-type=autofs :
EXAMPLES
Locations
Create a named location, “Baltimore”:
ipa automountlocation-add baltimoreDisplay the new location:
ipa automountlocation-show baltimoreFind available locations:
ipa automountlocation-findRemove a named automount location:
ipa automountlocation-del baltimoreShow what the automount maps would look like if they were in the filesystem:
ipa automountlocation-tofiles baltimoreImport an existing configuration into a location:
ipa automountlocation-import baltimore /etc/auto.master The import will fail if any duplicate entries are found. For continuous operation where errors are ignored, use the --continue option.
Maps
Create a new map, “auto.share”:
ipa automountmap-add baltimore auto.shareDisplay the new map:
ipa automountmap-show baltimore auto.shareFind maps in the location baltimore:
ipa automountmap-find baltimoreCreate an indirect map with auto.share as a submount:
ipa automountmap-add-indirect baltimore --parentmap=auto.share --mount=sub auto.man This is equivalent to: ipa automountmap-add-indirect baltimore --mount=/man auto.man ipa automountkey-add baltimore auto.man --key=sub --info="-fstype=autofs ldap:auto.share"Remove the auto.share map:
ipa automountmap-del baltimore auto.share
Keys
Create a new key for the auto.share map in location baltimore. This ties
the map we previously created to auto.master:
ipa automountkey-add baltimore auto.master --key=/share --info=auto.shareCreate a new key for our auto.share map, an NFS mount for man pages:
ipa automountkey-add baltimore auto.share --key=man --info="-ro,soft,rsize=8192,wsize=8192 ipa.example.com:/shared/man"Find all keys for the auto.share map:
ipa automountkey-find baltimore auto.shareFind all direct automount keys:
ipa automountkey-find baltimore --key=/-Remove the man key from the auto.share map:
ipa automountkey-del baltimore auto.share --key=man
Use Cases
Multi-Site NFS Infrastructure with Location-Based Automount
Organizations with multiple geographic locations maintain separate automount configurations per site to reference local NFS servers for optimal performance and reduced WAN traffic.
# Create location for Boston datacenter
ipa automountlocation-add boston
# Create shared data map with local NFS server
ipa automountmap-add boston auto.share
ipa automountkey-add boston auto.master --key=/share --info=auto.share
ipa automountkey-add boston auto.share --key=data \
--info="-ro,hard,intr bos-nfs01.example.com:/export/data"
# Create location for London datacenter referencing London NFS
ipa automountlocation-add london
ipa automountmap-add london auto.share
ipa automountkey-add london auto.master --key=/share --info=auto.share
ipa automountkey-add london auto.share --key=data \
--info="-ro,hard,intr lon-nfs01.example.com:/export/data"
# Configure autofs on hosts to use location-specific maps
# Boston hosts reference boston location, London hosts use londonHome Directory Automount with User-Specific Subdirectories
Centralized home directory management with automount enables users to access their home directories from any enrolled system without manual NFS mount configuration.
# Create indirect map for home directories
ipa automountmap-add-indirect default --mount=/home auto.home
# Add wildcard key matching all usernames to NFS export path
ipa automountkey-add default auto.home --key='*' \
--info="-rw,hard,intr,sec=krb5 nfs.example.com:/export/home/&"
# The & substitutes the key (username) into the NFS path
# User jsmith accessing /home/jsmith triggers mount of nfs:/export/home/jsmithApplication-Specific Direct Mounts for Database Files
Database applications require consistent mount paths across all servers. Direct mounts ensure specific paths are always mounted identically regardless of the automount location hierarchy.
# Add direct mount for Oracle database files at /u01
ipa automountkey-add default auto.direct --key=/u01 \
--info="-rw,hard,bg,nointr,rsize=131072,wsize=131072 oracle-nfs.example.com:/vol/ora01"
# Add another direct mount for archived logs at /archive
ipa automountkey-add default auto.direct --key=/archive \
--info="-ro,soft,intr archive-nfs.example.com:/vol/archive"
# Direct mounts appear in auto.direct map which is automatically created
# and mounted on /- when location is createdSubmount Hierarchies for Project Workspace Organization
Large organizations organize project data using submount hierarchies where parent maps contain references to child maps, creating nested mount point structures.
# Create parent map for all projects
ipa automountmap-add-indirect default --mount=/projects auto.projects
# Create submount for engineering projects under /projects/engineering
ipa automountmap-add-indirect default --parentmap=auto.projects \
--mount=engineering auto.eng
# Add specific engineering project mounts
ipa automountkey-add default auto.eng --key=firmware \
--info="-rw,hard nfs.example.com:/projects/eng/firmware"
ipa automountkey-add default auto.eng --key=hardware \
--info="-rw,hard nfs.example.com:/projects/eng/hardware"
# Create submount for marketing projects
ipa automountmap-add-indirect default --parentmap=auto.projects \
--mount=marketing auto.mkt
ipa automountkey-add default auto.mkt --key=campaigns \
--info="-rw,hard nfs.example.com:/projects/mkt/campaigns"
# Results in mount structure:
# /projects/engineering/firmware -> nfs:/projects/eng/firmware
# /projects/engineering/hardware -> nfs:/projects/eng/hardware
# /projects/marketing/campaigns -> nfs:/projects/mkt/campaignsMigrating Existing Automount Configuration to IPA
Organizations migrating from standalone autofs configuration files can import existing auto.master and associated map files into IPA for centralized management.
# Import existing automount configuration into default location
ipa automountlocation-import default /etc/auto.master
# Import may fail on duplicate entries; use --continue to skip errors
ipa automountlocation-import default /etc/auto.master --continue
# Verify imported configuration
ipa automountmap-find default
ipa automountkey-find default auto.master
# Export configuration for verification or migration to another location
ipa automountlocation-tofiles default > /tmp/auto.master.ipa
# Compare with original files to verify correctness
diff /etc/auto.master /tmp/auto.master.ipaRead-Write NFS Mounts with Kerberos Security for Development Teams
Development environments require secure read-write access to shared source code repositories using Kerberos authentication to enforce access controls.
# Create map for development mounts with Kerberos security
ipa automountmap-add-indirect default --mount=/devel auto.devel
# Add source code repository with sec=krb5 for authentication
ipa automountkey-add default auto.devel --key=source \
--info="-rw,hard,intr,sec=krb5 git-nfs.example.com:/repos/source"
# Add build output directory with sec=krb5i for integrity protection
ipa automountkey-add default auto.devel --key=builds \
--info="-rw,hard,intr,sec=krb5i build-nfs.example.com:/builds"
# sec=krb5p provides privacy (encryption) for sensitive data
ipa automountkey-add default auto.devel --key=secrets \
--info="-rw,hard,nosuid,sec=krb5p vault-nfs.example.com:/secrets"Disaster Recovery with Alternative NFS Server Failover
Automount configurations can specify multiple NFS servers for automatic failover, improving availability when primary servers are unavailable.
# Create map with replicated mounts pointing to primary and backup servers
ipa automountmap-add-indirect default --mount=/data auto.data
# Specify multiple servers separated by comma for automatic failover
ipa automountkey-add default auto.data --key=critical \
--info="-ro,hard,intr nfs01.example.com,nfs02.example.com:/critical/data"
# NFS client will try nfs01 first, automatically failing over to nfs02
# Servers must export identical paths for seamless failoverSoftware Distribution with Read-Only Application Mounts
IT teams distribute software packages and application binaries via read-only NFS mounts to ensure consistency and prevent unauthorized modifications.
# Create indirect map for software distribution
ipa automountmap-add-indirect default --mount=/software auto.software
# Add read-only mounts for various applications
ipa automountkey-add default auto.software --key=oracle \
--info="-ro,hard,nodev,nosuid soft-nfs.example.com:/software/oracle"
ipa automountkey-add default auto.software --key=matlab \
--info="-ro,hard,nodev,nosuid soft-nfs.example.com:/software/matlab"
# nosuid and nodev prevent security risks from executable binaries
# Soft mounts with timeouts for non-critical software
ipa automountkey-add default auto.software --key=legacy \
--info="-ro,soft,timeo=10,retrans=3 archive.example.com:/software/legacy"Temporary Workspace Automount for Build Processes
Build systems require large temporary workspaces that are automatically mounted on demand and unmounted after inactivity to conserve resources.
# Create map for temporary build workspaces
ipa automountmap-add-indirect default --mount=/buildspace auto.builds
# Add wildcard mount for per-project build directories
ipa automountkey-add default auto.builds --key='*' \
--info="-rw,hard,nodev,nosuid,noatime builds.example.com:/tmp/builds/&"
# noatime improves performance by skipping access time updates
# Build process creates /buildspace/project-name triggering mount
# autofs unmounts after timeout period (default 300 seconds)Security Considerations
Automount Map Disclosure Reveals Infrastructure Topology
Automount maps contain sensitive information about NFS server locations, network topology, and data organization. Unauthorized access to map contents allows reconnaissance of storage infrastructure, identifying high-value targets for data exfiltration or denial of service attacks. Anonymous LDAP binds or overly permissive read access to automount entries in the directory can expose this information to unauthorized users.
Implement strict access controls on automount LDAP entries using ACI (Access Control Instructions) to restrict read access to only enrolled hosts and administrative users. Disable anonymous binds and require authenticated LDAP connections. Regular audits of directory access logs can identify unauthorized attempts to enumerate automount configuration.
NFS Server Credentials in Mount Options Expose Sensitive Data
Mount options specified in automountkey info fields may contain authentication credentials, Kerberos service principals, or other sensitive parameters. These values are stored in LDAP and transmitted to clients in cleartext unless LDAPS or STARTTLS is enforced. Compromise of these credentials enables unauthorized NFS access or impersonation of legitimate services.
Avoid embedding credentials directly in mount options. Use Kerberos authentication (sec=krb5) which relies on host keytabs rather than embedded credentials. Enforce LDAPS for all client-server communication to prevent credential interception. Implement certificate-based authentication for additional security in high-risk environments.
Wildcard Mounts Enable Path Traversal and Unauthorized Access
Wildcard automount keys (using * or &) provide flexible mount patterns but can create security vulnerabilities if not carefully validated. Attackers may manipulate the substituted key value to access unintended filesystem paths, traverse directory boundaries, or mount sensitive system directories with inappropriate permissions.
Implement strict validation of substituted values at the NFS server level using export restrictions and directory permissions. Use NFSv4 with idmapping to enforce consistent UID/GID-based access controls. Avoid overly permissive wildcard patterns; prefer explicit mount keys for sensitive or high-security data. Monitor NFS server logs for suspicious mount patterns or path traversal attempts.
Direct Mount Privilege Escalation Through System Directory Overlap
Direct mounts specified in auto.direct can overlay critical system directories if keys are configured incorrectly. Mounting attacker-controlled NFS exports over /etc, /bin, or other system paths enables arbitrary code execution, configuration manipulation, or privilege escalation when the system reads executables or configuration files from the malicious mount.
Implement strict validation of direct mount keys to prevent overlap with system directories. Use mount namespace isolation or SELinux contexts to restrict autofs mount points to designated directory trees. Configure autofs to drop privileges and use restrictive mount options (nosuid, nodev, noexec) for untrusted NFS sources. Regular audits of auto.direct entries can identify dangerous mount configurations before exploitation.
Unencrypted NFS Traffic Exposes Data in Transit
Default NFS mount options transmit data in cleartext, enabling network eavesdropping and man-in-the-middle attacks. Sensitive data including authentication tokens, proprietary information, and personal data are vulnerable to interception when traversing untrusted networks or multi-tenant cloud environments.
Enforce Kerberos privacy mode (sec=krb5p) for all sensitive NFS mounts to enable encryption of data in transit. Use IPsec or VPN tunnels for additional network-layer protection in high-security environments. Implement network segmentation to isolate NFS traffic to dedicated VLANs with restricted access. Regular network traffic analysis can detect unencrypted NFS communication and policy violations.
Automount Location Manipulation for Redirected Mounts
Clients retrieve automount configuration based on their assigned location. If location assignment can be manipulated through DNS, LDAP injection, or compromised enrollment processes, attackers can redirect clients to malicious automount maps containing references to attacker-controlled NFS servers, enabling data exfiltration or malware distribution.
Implement secure host enrollment processes with validation of host identity before location assignment. Use DNSSEC to protect DNS-based location resolution from spoofing. Implement LDAP access controls preventing clients from modifying their own location assignments. Monitor for unexpected location changes or creation of unauthorized automount locations.
Soft Mount Timeouts Create Denial of Service Vulnerabilities
Automount configurations using soft mounts with aggressive timeout values can create application failures when NFS servers become temporarily unavailable. While soft mounts prevent indefinite hangs, critical applications may fail or corrupt data when I/O operations time out prematurely. Attackers can exploit this behavior by disrupting NFS network connectivity, causing widespread application outages.
Use hard mounts for critical data and applications requiring consistency guarantees. Reserve soft mounts for non-critical data where temporary unavailability is acceptable. Implement comprehensive monitoring of NFS server availability and mount health. Configure appropriate timeout and retrans values balancing responsiveness against premature failure. Use high-availability NFS configurations with automatic failover for mission-critical mounts.
Submount Infinite Loops Through Circular References
Automount submounts can reference other maps creating hierarchical mount structures. Misconfigured submounts creating circular references (map A references map B which references map A) can cause infinite loops in autofs, resulting in resource exhaustion, system hangs, or denial of service conditions when users attempt to access the mount path.
Implement validation during map creation to detect circular submount references. Use directed acyclic graph analysis tools to verify map hierarchy integrity before deployment. Implement depth limits in submount traversal to prevent runaway recursion. Monitor autofs logs for mounting failures or timeout errors indicating potential circular reference issues.
Map Import Injection Through Malicious Configuration Files
The automountlocation-import command processes existing autofs configuration files which may contain maliciously crafted entries. Importing untrusted or attacker-modified configuration files can inject malicious mount points, redirect legitimate paths to attacker-controlled servers, or introduce other security vulnerabilities into the centralized IPA automount configuration.
Validate all imported configuration files before import operations. Implement syntax checking and whitelist validation of NFS server names to prevent injection of unauthorized servers. Use the —continue flag carefully as it may skip security violations along with benign duplicates. Review imported maps immediately after import using automountlocation-tofiles and compare against expected configuration. Restrict import operations to highly privileged administrative accounts.
Automount Race Conditions During Map Updates
Concurrent modifications to automount maps can create race conditions where clients retrieve inconsistent or partially updated configurations. In distributed environments with multiple IPA replicas, replication lag can cause different clients to receive different map configurations, leading to mount failures, incorrect data access, or security policy bypass when updated mount restrictions have not propagated.
Implement change management procedures requiring maintenance windows for critical automount map updates. Use IPA’s built-in replication status monitoring to verify configuration changes have propagated to all replicas before announcing changes to clients. Configure autofs cache timeouts appropriately to balance performance against configuration consistency requirements. Implement phased rollouts of map changes starting with non-production hosts.
NFS Export Restrictions Bypass Through Alternative Automount Paths
NFS servers enforce export restrictions based on mount paths and client hosts. Automount configurations creating alternative paths to the same underlying NFS export may bypass intended export restrictions if not carefully coordinated with NFS server configuration. Attackers with automount modification privileges can create new mount keys accessing restricted exports through unrestricted paths.
Implement consistent export policies across all potential mount paths on NFS servers. Use NFSv4 with strong authentication and path-based export restrictions to enforce access controls independent of mount path. Regular audits correlating automount map entries with NFS export configurations can identify potential bypass vulnerabilities. Restrict automount map modification privileges to administrators who also manage NFS export policies.
Location Deletion Without Cleanup Leaves Orphaned Client Configuration
Deleting automount locations without proper client coordination leaves enrolled systems with references to non-existent maps, causing mount failures and application errors. In large environments, tracking which clients use which locations can be difficult, making cleanup operations risky and potentially disruptive to production systems.
Implement location lifecycle management procedures documenting which host groups or geographic regions use each location. Use configuration management tools (Ansible, Puppet) to coordinate location changes across affected clients. Before deleting locations, query LDAP for any hosts still referencing the location and migrate them to alternative locations. Implement monitoring for autofs mount failures that may indicate orphaned location references.
Automount Debugging Disclosure in Verbose Logs
Troubleshooting automount issues often requires enabling verbose logging in autofs which includes detailed mount information, NFS server names, authentication credentials, and internal system paths. These logs may be accessible to unauthorized users through log aggregation systems or insufficiently protected log files, exposing sensitive infrastructure details.
Implement strict access controls on autofs log files and log aggregation systems. Disable verbose logging when not actively troubleshooting. Sanitize logs before sharing with third parties or lower-privileged support personnel. Use short-term debug logging activation with automatic timeout to prevent logs remaining in verbose mode indefinitely. Regular log review processes should identify and remediate any credential exposure in historical logs.
Troubleshooting
Automount Maps Not Visible to Clients After Configuration
Symptom: Newly created automount maps and keys are not visible to enrolled clients; ls /mount/path does not trigger mounts even though IPA configuration appears correct.
Diagnosis: Verify IPA replication has completed: ipa-replica-manage list and check for replication errors. Confirm autofs is configured to use IPA: grep ldap /etc/autofs.conf and /etc/nsswitch.conf should have automount: sss or automount: ldap. Check SSSD cache: sss_cache -E to clear cached automount data.
Resolution: Restart autofs service: systemctl restart autofs. Force SSSD to refresh automount maps: sss_cache -A && systemctl restart sssd. Verify client can read automount data: ldapsearch -Y GSSAPI -b "cn=default,cn=automount,dc=example,dc=com". If replication issues exist, resolve with ipa-replica-manage re-initialize --from=master.example.com.
Direct Mount Keys Conflict with Existing Filesystem Paths
Symptom: Direct mounts specified in auto.direct fail to mount with errors like “mount point /path already exists” or autofs shows “key already mounted” in logs.
Diagnosis: Check if mount point path exists and is already mounted: mount | grep /path and ls -ld /path. Verify no conflicts with existing filesystem structure: direct mount paths must not overlap with local filesystem directories containing files. Review /proc/mounts for existing autofs mounts on the same path.
Resolution: Choose non-conflicting mount points for direct mounts avoiding system directories and existing application paths. If path must be used, unmount any existing mounts: umount /path and ensure directory is empty. Remove directory if it contains only placeholder content: rmdir /path. After fixing conflicts, reload autofs: systemctl reload autofs.
Submount References Create “No such file or directory” Errors
Symptom: Accessing submount paths returns “No such file or directory” errors even though parent mount works correctly and submount map exists in IPA.
Diagnosis: Verify submount reference syntax in parent map: ipa automountkey-find default auto.master --key=/parent. The info field should be exactly the map name (e.g., auto.submount) or use type specification (-type=autofs :auto.submount). Check if submount map exists: ipa automountmap-show default auto.submount. Review autofs debug logs: systemctl stop autofs && automount -f -v to see submount resolution attempts.
Resolution: Fix submount key info syntax. For implicit submount: ipa automountkey-mod default auto.master --key=/parent --newinfo=auto.submount. For explicit submount: ipa automountkey-mod default auto.master --key=/parent --newinfo="-type=autofs :auto.submount". Verify map hierarchy using automountlocation-tofiles to see complete configuration. Reload autofs after corrections.
Wildcard Mount Substitution Not Working Correctly
Symptom: Wildcard automount keys using * and & substitution do not mount correctly; literal & appears in mount path instead of substituted value.
Diagnosis: Verify wildcard key syntax: info field must use & for substitution of the matched key value. Check autofs logs for substitution errors: journalctl -u autofs -n 100. Test with explicit key: create temporary explicit key matching expected pattern to verify NFS export path is correct. Confirm NFS server exports requested path: showmount -e nfs-server.
Resolution: Correct wildcard syntax: ipa automountkey-mod default auto.home --key='*' --newinfo='-rw,hard nfs:/export/home/&'. Note single quotes prevent shell interpretation of * and &. Verify NFS server exports support wildcard paths (e.g., /export/home/* or full /export/home export). Test with direct access: ls /home/testuser should trigger mount of nfs:/export/home/testuser. Check NFS export permissions allow client access.
Automount Location Import Fails with Duplicate Entry Errors
Symptom: automountlocation-import command fails with errors like “automount key already exists” or “duplicate entry” when importing existing autofs configuration files.
Diagnosis: Check if location already contains maps or keys: ipa automountmap-find location and ipa automountkey-find location auto.master. Review import source file for duplicate entries within the file itself. Verify previous partial imports may have created some entries before failing.
Resolution: Use --continue flag to skip duplicate entries and continue import: ipa automountlocation-import default /etc/auto.master --continue. For clean import, delete existing location and recreate: ipa automountlocation-del default && ipa automountlocation-add default, then retry import. Manually review duplicates to determine if existing IPA entries or import file is authoritative. Export current configuration first for backup: ipa automountlocation-tofiles default > backup.txt.
Maps Exported by tofiles Command Have Incorrect Syntax
Symptom: Using automountlocation-tofiles to export configuration produces output with syntax that does not match original autofs configuration files or cannot be parsed by standard autofs.
Diagnosis: Compare exported format with expected autofs syntax. IPA may store mount options differently than traditional autofs files. Review differences between IPA’s LDAP schema and file-based autofs schema. Check if export is for different autofs version or platform than original configuration.
Resolution: Manually edit exported files to match target autofs syntax requirements. Use exported configuration as reference rather than direct replacement for autofs files. Consider using automountlocation-import and automountlocation-tofiles as migration validation rather than production deployment method. For ongoing management, configure clients to use SSSD for direct LDAP automount integration rather than exporting to files.
NFS Mounts Fail with Permission Denied Despite Correct Kerberos Authentication
Symptom: Automounted NFS shares with sec=krb5 mount successfully but file access returns “Permission denied” errors even though user has valid Kerberos ticket and correct POSIX permissions.
Diagnosis: Verify NFS server has host principal and keytab: klist -k /etc/krb5.keytab | grep nfs. Check NFS server exports use correct security flavor: exportfs -v | grep sec=. Confirm client has NFS service principals: klist -k | grep nfs. Test NFS access without Kerberos: temporarily use sec=sys to isolate Kerberos vs permission issues.
Resolution: Ensure NFS server has valid NFS service principal: ipa service-add nfs/nfs-server.example.com and retrieve keytab: ipa-getkeytab -s ipa.example.com -p nfs/nfs-server.example.com -k /etc/krb5.keytab. On NFS client, verify nfs-client services are running: systemctl start nfs-client.target. Update automount key to use correct security flavor matching NFS export: ipa automountkey-mod default auto.share --key=data --newinfo='-rw,sec=krb5 nfs:/export'. Restart NFS services on both server and client.
Autofs Consumes Excessive CPU During Map Refresh
Symptom: autofs daemon uses high CPU periodically causing system performance degradation. Occurs especially on systems with large numbers of automount maps or keys.
Diagnosis: Check autofs cache timeout configuration: grep timeout /etc/autofs.conf. Monitor when CPU spikes occur relative to cache expiration. Count number of automount keys client receives: ldapsearch -Y GSSAPI -b "cn=default,cn=automount,dc=example,dc=com" automountKey | grep -c automountKey. Review autofs logs during high CPU periods for excessive lookup activity.
Resolution: Increase autofs timeout value to reduce refresh frequency: edit /etc/autofs.conf and set timeout = 600 (10 minutes). Reduce number of automount keys by consolidating maps or using wildcards instead of explicit keys. Implement location-based separation to reduce map size per client - move unused maps to different locations. Upgrade to newer autofs versions with improved performance. Consider using automountmap-add-indirect with submounts to partition large maps into smaller units.
Mount Points Persist After Automount Location Deletion
Symptom: After deleting automount location from IPA, clients still have old mount points visible and may show stale or inaccessible mounts.
Diagnosis: Check if autofs is still running and using cached data: systemctl status autofs. Verify SSSD cache still contains old automount data: ldbsearch -H /var/lib/sss/db/cache_example.com.ldb autofsMountPoint. Review if clients are still configured to use deleted location.
Resolution: Clear SSSD autofs cache: sss_cache -A or full cache clear: sss_cache -E. Restart SSSD: systemctl restart sssd. Restart autofs to release old mounts: systemctl restart autofs. If mounts persist, manually unmount: umount /mount/point. Update client configuration to use correct automount location if migrating to new location. For large-scale cleanup, use configuration management tools to coordinate cache clearing across all affected clients.
Automount Keys Not Applied After Modification
Symptom: Modifying existing automount key with automountkey-mod appears successful but clients continue using old mount information.
Diagnosis: Check autofs cache timeout: modified keys are not reloaded until cache expires or service restarts. Verify replication completed: changes may exist on IPA server but not yet replicated to SSSD’s connected replica. Test with ipa automountkey-show to confirm modification was saved. Check SSSD cache timestamp: ldbsearch -H /var/lib/sss/db/cache_example.com.ldb.
Resolution: Force immediate cache refresh on client: sss_cache -A && systemctl restart sssd && systemctl reload autofs. For critical changes requiring immediate effect, restart autofs: systemctl restart autofs. Use SSSD debug logging to see when new automount data is retrieved: edit /etc/sssd/sssd.conf add debug_level = 6 in [autofs] section, then systemctl restart sssd. Review logs in /var/log/sssd/sssd_autofs.log to confirm new data retrieval.
Multiple Locations Cause Client Confusion
Symptom: Clients have inconsistent automount behavior or access wrong maps when multiple automount locations exist in IPA.
Diagnosis: Verify which location client is configured to use. Default SSSD configuration uses location named “default”. Check /etc/sssd/sssd.conf for [autofs] section and autofs_provider settings. Confirm client is not switching between locations unexpectedly.
Resolution: Explicitly configure SSSD to use specific location: edit /etc/sssd/sssd.conf, add [autofs] section with ldap_autofs_map_master_name = auto.master and ldap_autofs_search_base = cn=default,cn=automount,dc=example,dc=com. Standardize on single location name across organization to prevent confusion. Use location-based separation only when genuinely needed (geography, environment). Document which client groups use which locations. Restart SSSD after configuration changes: systemctl restart sssd.
NFS Soft Mount Timeouts Cause Application Failures
Symptom: Applications fail with I/O errors when accessing automounted NFS shares configured with soft mount options, especially during network congestion or NFS server maintenance.
Diagnosis: Identify mount as soft: mount | grep soft. Review application error logs for I/O timeout messages. Check NFS server availability: showmount -e nfs-server and network latency: ping nfs-server. Monitor NFS statistics: nfsstat -c for timeout and retransmission counts.
Resolution: Change critical mounts from soft to hard: ipa automountkey-mod default auto.share --key=data --newinfo='-rw,hard,intr nfs:/export'. Use intr option with hard mounts to allow signal interruption preventing complete hangs. Increase timeout and retrans values for soft mounts if soft is required: -soft,timeo=100,retrans=5. Implement NFS server high availability with failover to reduce timeout probability. Use application-level retry logic for non-critical soft-mounted data. Monitor NFS server performance and address capacity issues proactively.
Submount Depth Exceeds autofs Limits
Symptom: Deep submount hierarchies fail to mount with errors like “too many levels” or “maximum nesting exceeded” in autofs logs.
Diagnosis: Count submount depth by reviewing map hierarchy with automountlocation-tofiles. Check autofs version for nesting limits: older versions may have restrictive limits. Review autofs logs: journalctl -u autofs | grep -i nest.
Resolution: Flatten submount hierarchy by reducing nesting levels. Combine intermediate maps where possible. Use direct mounts for deeply nested paths instead of submount chains. Upgrade autofs to newer version with increased nesting limits if available. Redesign automount structure to use parallel maps instead of deeply nested hierarchies: create multiple top-level indirect maps rather than submount chains. Test restructured configuration with automountlocation-tofiles before deployment.
Automount Commands Fail with “Location not found” Errors
Symptom: Commands like automountmap-add or automountkey-add fail with errors stating the specified location does not exist, even though automountlocation-show confirms the location is present.
Diagnosis: Verify exact location name including case sensitivity: ipa automountlocation-find. Check for typos in location name parameter. Confirm user has permissions to access automount entries: ipa automountlocation-show locationname --all --rights. Test on different IPA replica to rule out replication issues.
Resolution: Use exact location name from automountlocation-find output. Check for whitespace or special characters in location name that may not be visible. Verify user is member of appropriate role with automount privileges: ipa role-show 'Automount Administrators' and add user if needed. If location exists but commands fail, check LDAP directly: ldapsearch -Y GSSAPI -b "cn=automount,dc=example,dc=com" to verify location entry exists in directory. Force replication if entry is missing on some replicas: ipa-replica-manage force-sync --from=master.example.com.
Commands
automountkey-add
Usage:
ipa [global-options] automountkey-add AUTOMOUNTLOCATION AUTOMOUNTMAP [options]
Create a new automount key.
Arguments
| Argument | Required | Description |
|---|---|---|
AUTOMOUNTLOCATION | yes | Automount location name. |
AUTOMOUNTMAP yes Automount map name.
Options
| Option | Description |
|---|---|
--key KEY | Automount key name. |
--info INFO | Mount information |
--setattr SETATTR | Set an attribute to a name/value pair. Format is attr=value. |
--addattr ADDATTR | Add an attribute/value pair. Format is attr=value. The attribute |
--all | Retrieve and print all attributes from the server. Affects command output. |
--raw | Print entries as stored on the server. Only affects output format. |
automountkey-del
Usage:
ipa [global-options] automountkey-del AUTOMOUNTLOCATION AUTOMOUNTMAP [options]
Delete an automount key.
Arguments
| Argument | Required | Description |
|---|---|---|
AUTOMOUNTLOCATION | yes | Automount location name. |
AUTOMOUNTMAP yes Automount map name.
Options
| Option | Description |
|---|---|
--key KEY | Automount key name. |
--info INFO | Mount information |
automountkey-find
Usage:
ipa [global-options] automountkey-find AUTOMOUNTLOCATION AUTOMOUNTMAP [CRITERIA] [options]
Search for an automount key.
Arguments
| Argument | Required | Description |
|---|---|---|
AUTOMOUNTLOCATION | yes | Automount location name. |
AUTOMOUNTMAP yes Automount map name.
CRITERIA no A string searched in all relevant object
attributes
Options
| Option | Description |
|---|---|
--key KEY | Automount key name. |
--info INFO | Mount information |
--timelimit TIMELIMIT | Time limit of search in seconds (0 is unlimited) |
--sizelimit SIZELIMIT | Maximum number of entries returned (0 is unlimited) |
--all | Retrieve and print all attributes from the server. Affects command output. |
--raw | Print entries as stored on the server. Only affects output format. |
automountkey-mod
Usage:
ipa [global-options] automountkey-mod AUTOMOUNTLOCATION AUTOMOUNTMAP [options]
Modify an automount key.
Arguments
| Argument | Required | Description |
|---|---|---|
AUTOMOUNTLOCATION | yes | Automount location name. |
AUTOMOUNTMAP yes Automount map name.
Options
| Option | Description |
|---|---|
--key KEY | Automount key name. |
--info INFO | Mount information |
--setattr SETATTR | Set an attribute to a name/value pair. Format is attr=value. |
--addattr ADDATTR | Add an attribute/value pair. Format is attr=value. The attribute |
--delattr DELATTR | Delete an attribute/value pair. The option will be evaluated |
--rights | Display the access rights of this entry (requires —all). See ipa man page for details. |
--newinfo NEWINFO | New mount information |
--all | Retrieve and print all attributes from the server. Affects command output. |
--raw | Print entries as stored on the server. Only affects output format. |
--rename RENAME | Rename the automount key object |
automountkey-show
Usage:
ipa [global-options] automountkey-show AUTOMOUNTLOCATION AUTOMOUNTMAP [options]
Display an automount key.
Arguments
| Argument | Required | Description |
|---|---|---|
AUTOMOUNTLOCATION | yes | Automount location name. |
AUTOMOUNTMAP yes Automount map name.
Options
| Option | Description |
|---|---|
--rights | Display the access rights of this entry (requires —all). See ipa man page for details. |
--key KEY | Automount key name. |
--info INFO | Mount information |
--all | Retrieve and print all attributes from the server. Affects command output. |
--raw | Print entries as stored on the server. Only affects output format. |
automountlocation-add
Usage:
ipa [global-options] automountlocation-add LOCATION [options]
Create a new automount location.
Arguments
| Argument | Required | Description |
|---|---|---|
LOCATION | yes | Automount location name. |
Options
| Option | Description |
|---|---|
--setattr SETATTR | Set an attribute to a name/value pair. Format is attr=value. |
--addattr ADDATTR | Add an attribute/value pair. Format is attr=value. The attribute |
--all | Retrieve and print all attributes from the server. Affects command output. |
--raw | Print entries as stored on the server. Only affects output format. |
automountlocation-del
Usage:
ipa [global-options] automountlocation-del LOCATION [options]
Delete an automount location.
Arguments
| Argument | Required | Description |
|---|---|---|
LOCATION | yes | Automount location name. |
Options
| Option | Description |
|---|---|
--continue | Continuous mode: Don’t stop on errors. |
automountlocation-find
Usage:
ipa [global-options] automountlocation-find [CRITERIA] [options]
Search for an automount location.
Arguments
Argument Required Description
CRITERIA no A string searched in all relevant object
attributes
Options
| Option | Description |
|---|---|
--location LOCATION | Automount location name. |
--timelimit TIMELIMIT | Time limit of search in seconds (0 is unlimited) |
--sizelimit SIZELIMIT | Maximum number of entries returned (0 is unlimited) |
--all | Retrieve and print all attributes from the server. Affects command output. |
--raw | Print entries as stored on the server. Only affects output format. |
--pkey-only | Results should contain primary key attribute only (“location”) |
automountlocation-show
Usage:
ipa [global-options] automountlocation-show LOCATION [options]
Display an automount location.
Arguments
| Argument | Required | Description |
|---|---|---|
LOCATION | yes | Automount location name. |
Options
| Option | Description |
|---|---|
--rights | Display the access rights of this entry (requires —all). See ipa man page for details. |
--all | Retrieve and print all attributes from the server. Affects command output. |
--raw | Print entries as stored on the server. Only affects output format. |
automountlocation-tofiles
Usage:
ipa [global-options] automountlocation-tofiles LOCATION [options]
Generate automount files for a specific location.
Arguments
| Argument | Required | Description |
|---|---|---|
LOCATION | yes | Automount location name. |
automountmap-add
Usage:
ipa [global-options] automountmap-add AUTOMOUNTLOCATION MAP [options]
Create a new automount map.
Arguments
| Argument | Required | Description |
|---|---|---|
AUTOMOUNTLOCATION | yes | Automount location name. |
MAP yes Automount map name.
Options
| Option | Description |
|---|---|
--desc DESC | Description |
--setattr SETATTR | Set an attribute to a name/value pair. Format is attr=value. |
--addattr ADDATTR | Add an attribute/value pair. Format is attr=value. The attribute |
--all | Retrieve and print all attributes from the server. Affects command output. |
--raw | Print entries as stored on the server. Only affects output format. |
automountmap-add-indirect
Usage:
ipa [global-options] automountmap-add-indirect AUTOMOUNTLOCATION MAP [options]
Create a new indirect mount point.
Arguments
| Argument | Required | Description |
|---|---|---|
AUTOMOUNTLOCATION | yes | Automount location name. |
MAP yes Automount map name.
Options
| Option | Description |
|---|---|
--desc DESC | Description |
--setattr SETATTR | Set an attribute to a name/value pair. Format is attr=value. |
--addattr ADDATTR | Add an attribute/value pair. Format is attr=value. The attribute |
--mount MOUNT | Mount point |
--parentmap PARENTMAP | Name of parent automount map (default: auto.master). |
--all | Retrieve and print all attributes from the server. Affects command output. |
--raw | Print entries as stored on the server. Only affects output format. |
automountmap-del
Usage:
ipa [global-options] automountmap-del AUTOMOUNTLOCATION MAP [options]
Delete an automount map.
Arguments
| Argument | Required | Description |
|---|---|---|
AUTOMOUNTLOCATION | yes | Automount location name. |
MAP yes Automount map name.
Options
| Option | Description |
|---|---|
--continue | Continuous mode: Don’t stop on errors. |
automountmap-find
Usage:
ipa [global-options] automountmap-find AUTOMOUNTLOCATION [CRITERIA] [options]
Search for an automount map.
Arguments
| Argument | Required | Description |
|---|---|---|
AUTOMOUNTLOCATION | yes | Automount location name. |
CRITERIA no A string searched in all relevant object
attributes
Options
| Option | Description |
|---|---|
--map MAP | Automount map name. |
--desc DESC | Description |
--timelimit TIMELIMIT | Time limit of search in seconds (0 is unlimited) |
--sizelimit SIZELIMIT | Maximum number of entries returned (0 is unlimited) |
--all | Retrieve and print all attributes from the server. Affects command output. |
--raw | Print entries as stored on the server. Only affects output format. |
--pkey-only | Results should contain primary key attribute only (“map”) |
automountmap-mod
Usage:
ipa [global-options] automountmap-mod AUTOMOUNTLOCATION MAP [options]
Modify an automount map.
Arguments
| Argument | Required | Description |
|---|---|---|
AUTOMOUNTLOCATION | yes | Automount location name. |
MAP yes Automount map name.
Options
| Option | Description |
|---|---|
--desc DESC | Description |
--setattr SETATTR | Set an attribute to a name/value pair. Format is attr=value. |
--addattr ADDATTR | Add an attribute/value pair. Format is attr=value. The attribute |
--delattr DELATTR | Delete an attribute/value pair. The option will be evaluated |
--rights | Display the access rights of this entry (requires —all). See ipa man page for details. |
--all | Retrieve and print all attributes from the server. Affects command output. |
--raw | Print entries as stored on the server. Only affects output format. |
automountmap-show
Usage:
ipa [global-options] automountmap-show AUTOMOUNTLOCATION MAP [options]
Display an automount map.
Arguments
| Argument | Required | Description |
|---|---|---|
AUTOMOUNTLOCATION | yes | Automount location name. |
MAP yes Automount map name.
Options
| Option | Description |
|---|---|
--rights | Display the access rights of this entry (requires —all). See ipa man page for details. |
--all | Retrieve and print all attributes from the server. Affects command output. |
--raw | Print entries as stored on the server. Only affects output format. |