pam_mount not working when logging in from ssh or console

okay so i configured pam_mount on my centos 6 machine as i did on my centos 7 and 5 machines.

But when i login locally or via ssh, pam_mount can't mount my home dir. when i login with a local user, and su to a user who needs the hmoe dir mounted pam_mount works fine and mount the home dir.

the error i get, when i ssh or log in from console is found in /var/log/messages:

Feb 13 14:27:52 centosy sshd[1224]: pam_mount(mount.c:64): Errors from underlying mount program:
Feb 13 14:27:52 centosy sshd[1224]: pam_mount(mount.c:68): mount error(13): Permission denied
Feb 13 14:27:52 centosy sshd[1224]: pam_mount(mount.c:68): Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)
Feb 13 14:27:52 centosy sshd[1224]: pam_mount(pam_mount.c:521): mount of tomas failed
Feb 13 14:27:52 centosy sshd[1224]: pam_mount(pam_mount.c:172): conv->conv(...): Conversation error
Feb 13 14:27:52 centosy sshd[1224]: pam_mount(pam_mount.c:476): warning: could not obtain password interactively either
Feb 13 14:28:00 centosy sshd[1224]: pam_mount(mount.c:64): umount messages:
Feb 13 14:28:00 centosy sshd[1224]: pam_mount(mount.c:68): umount: /home/tomas: not mounted
Feb 13 14:28:00 centosy sshd[1224]: pam_mount(mount.c:722): unmount of tomas failed
Feb 13 14:33:59 centosy kernel: Status code returned 0xc000006d NT_STATUS_LOGON_FAILURE
Feb 13 14:33:59 centosy kernel: CIFS VFS: Send error in SessSetup = -13
Feb 13 14:33:59 centosy kernel: CIFS VFS: cifs_mount failed w/return code = -13

my pam.d/system-auth:

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_ldap.so use_first_pass
auth        required      pam_deny.so
auth        optional      pam_mount.so

account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    sufficient    pam_ldap.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_ldap.so
session     optional      pam_mount.so
session     required      pam_mkhomedir.so skel=/etc/skel/ umask=0022

my pam.d/password-auth:

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_ldap.so use_first_pass
auth        required      pam_deny.so
auth        optional      pam_mount.so

account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    sufficient    pam_ldap.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_ldap.so
session     optional      pam_mount.so
session     required      pam_mkhomedir.so skel=/etc/skel/ umask=0022

my pam_mount.conf.xml:

?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">
<!--
        See pam_mount.conf(5) for a description.
-->

<pam_mount>

            <!-- debug should come before everything else,
                since this file is still processed in a single pass
                from top-to-bottom -->

<debug enable="0" />

                <!-- Volume definitions -->
<volume user="*" fstype="cifs" server="zentyal" path="%(DOMAIN_USER)" mountpoint="/home/%(DOMAIN_USER)" options="sec=ntlmsspi,nodev,nosuid" />

                <!-- pam_mount parameters: General tunables -->

<!--
<luserconf name=".pam_mount.conf.xml" />
-->

<!-- Note that commenting out mntoptions will give you the defaults.
     You will need to explicitly initialize it with the empty string
     to reset the defaults to nothing. -->
<mntoptions allow="nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other" />
<!--
<mntoptions deny="suid,dev" />
<mntoptions allow="*" />
<mntoptions deny="*" />
-->
<mntoptions require="nosuid,nodev" />

<logout wait="0" hup="0" term="0" kill="0" />


                <!-- pam_mount parameters: Volume-related -->

<mkmountpoint enable="1" remove="true" />


</pam_mount>

can anyone see the error, and knows how to fix this?

You can follow up my instruction. This works for me on Centos 7.0 & 7.1 and has not been tested on Centos 6.X.

Step 1: Install pam_mount and cifs-utils.

Step 2: Please only configure file /etc/pam.d/password-auth, just add 2 lines ( one is on top, and the one is at the end of the file)

auth        required      pam_mount.so
auth        required      pam_env.so

# ... file's other contents ...

session     optional      pam_winbind.so
session     optional      pam_mount.so

Step 3: Configure /etc/security/pam_mount.conf.xml

    <!-- pam_mount parameters: Volume-related -->
    <mkmountpoint enable="1" remove="true" />

    <volume user="*" fstype="cifs" server="fileserver" path="shared name of directory" mountpoint="/mnt/" options="sec=ntlm,nodev,nosuid" />
</pam_mount>

Remember : Disable SElinux.