As I was setting up my WiFi, I found a tutorial to hash my password so it wouldn't be stored in plaintext (we use username/password for wifi access)


where HASH is

echo -n 'YOUR_REAL_PASSWORD' | iconv -t utf16le | openssl md4

Is there a way to do something similar for a Windows network mount? I currently use mount -t cifs -o username=USERNAME,password=PASSWD // /mnt/share to mount a network share, but I'd like to keep my password out of plaintext (I'm aware of ways to secure the plaintext or make it only readable by root, that's not what I want).

Can I hash my password for a cifs network share in a similar manner to what I was able to do for WiFi?

  • 2
    No, just like the mount.cifs(8) man page says. Commented May 30, 2018 at 21:01
  • 1
    Note that whatever format you save the password in, if an attacker gets to read the configuration file where it is, they can use it to access the same system you're using. Obscuring the password with a hash will only work to prevent using the same (plaintext) password for another service or system, but that's easier to prevent by not using the same password in multiple places to begin with...
    – ilkkachu
    Commented May 30, 2018 at 21:18
  • @IgnacioVazquez-Abrams that's a shame. Thanks anyway!
    – brndn2k
    Commented May 30, 2018 at 21:24
  • Look at the Kerberos option, as detailed over at superuser.com/a/1241316/332907. No password required (for the mount). Commented May 30, 2018 at 22:21
  • 1
    You can always create a credential file that only root can read, but I guess from the context you already know that. Commented May 31, 2018 at 0:20

1 Answer 1


No, you cannot obscure the password. Your computer needs to be able to present the password to the server. This means that whatever means you use to obscure the password, your computer has to be able to take that obscured form and decode it. If your computer can do it, anybody's computer can do it.

The case of EAP is different on the surface because for EAP the client needs to present the NTML hash of the password. But that means that effectively the password is that hash and not the human-readable input. So in fact, even with hash: in the configuration file, the configuration file does contain the password in cleartext.

The tutorial you read is very misleading by implying that hashing the EAP password in the file has a significant security benefit. In fact, it has no benefit at all if you don't use that password for anything else, since as we saw above the effective password is the hash. If the same password is also used for something else (where the server wants the password and not its hash) then there is some benefit, but it's limited because MD4 is quite easy to brute force.

If you don't want to type your password every time, your best bet is to store the password in a password manager and make sure that only you can access the password manager. Make sure that it's encrypted on disk in case someone steals your computer (of course this means that you'll have to decrypt the password container at some point after bootig). But if someone gains access to your computer, they'll gain access to the password. There's no way to prevent that.

If you can influence the server's configuration and want to improve security, consider enabling Kerberos authentication, which if configured thoroughly can let you access network shares using your login password.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .