Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am trying to setup an auto-mounting network drive. The network drive requires a user/pass. In the man page for "mount.cifs" there are two ways to provide the user/pass.

  1. [not recommended] put the user/pass in /etc/fstab
  2. create a separate credentials file and put the user/pass in the credentials file

"[option 2] is preferred over having passwords in plaintext in a shared file, such as /etc/fstab. Be sure to protect any credentials file properly."

  • My background is: software developer, lots of linux software development (installing development libraries, installing applications like Eclipse, or java). I am not an IT or sysadmin guy.
  • This is on my own development machine

Given my lack of IT/sysadmin background, what is the standard suggested method for "protecting any credentials file properly"?

(I would also appreciate, if there are multiple methods for protecting the credentials file, to please list in order of most common to least and describe the tradeoffs.)

share|improve this question

2 Answers 2

up vote 7 down vote accepted

It looks like the man page snippets you quoted refer to the basic level of security that standard file ownership and permissions provide. The configuration file /etc/fstab is readable by any user on the system. A safer place to store sensitive information would be a file with permissions allowing to be read only by the owner. I understand that in your case, the user would be root.

Let's say you put the file in /etc/ and name it cifs-cred (create and edit it as root). Then you'd use

chmod 600 /etc/cifs-cred

That will assure only the owner (which should be root) will have access to the contents. Otherwise, if such setup did not allow proper working of your system setup, it could mean the file should be accessible to some special system user. In that case, you might need to try

chmod 660 /etc/cifs-cred

or something like

chown root:wheel /etc/cifs-cred
chmod 660 /etc/cifs-cred

-- depending on what *nix flavor your system is and the system daemons' configuration.


Other than that, if the system can be under any risk of being compromised, you should never trust unencrypted passwords. Depending solely on file permissions is rather naive - the file contents are protected only against minor security breaches.

share|improve this answer
    
are there any unix.stackexchange.com questions or websites that talk about getting the same output... but don't 'solely depend on file permissions'? –  Trevor Boyd Smith Sep 17 '11 at 21:52
    
Unfortunately, this part is application dependent. Some programs and applications have support for hashed passwords, others don't. I don't know what is the situation with CIFS/SMB, but honestly I doubt if there is a really secure alternative in this case. You might look at IT Security for more information. –  rozcietrzewiacz Sep 18 '11 at 0:05

Just only set the unix rights to rw for the mounting user:

cat > ~/cifs.credentials <<EOC
user=UserName
pass=PassWord
EOC
chmod 0600 ~/cifs.credentials

All other user has no access to this file after the chmod command

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.