1

As I was setting up my WiFi, I found a tutorial to hash my password so it wouldn't be stored in plaintext (we use username/password for wifi access)

network={
    ssid="NETWORKNAME"
    priority=1
    proto=RSN
    key_mgmt=WPA-EAP
    pairwise=CCMP
    auth_alg=OPEN
    eap=PEAP
    identity="USERNAME"
    password=hash:HASH
    phase1="peaplabel=0" 
    phase2="auth=MSCHAPV2"
}

where HASH is

echo -n 'YOUR_REAL_PASSWORD' | iconv -t utf16le | openssl md4

Is there a way to do something similar for a Windows network mount? I currently use mount -t cifs -o username=USERNAME,password=PASSWD //192.168.1.88/shares /mnt/share to mount a network share, but I'd like to keep my password out of plaintext (I'm aware of ways to secure the plaintext or make it only readable by root, that's not what I want).

Can I hash my password for a cifs network share in a similar manner to what I was able to do for WiFi?

| improve this question | | | | |
  • 2
    No, just like the mount.cifs(8) man page says. – Ignacio Vazquez-Abrams May 30 '18 at 21:01
  • 1
    Note that whatever format you save the password in, if an attacker gets to read the configuration file where it is, they can use it to access the same system you're using. Obscuring the password with a hash will only work to prevent using the same (plaintext) password for another service or system, but that's easier to prevent by not using the same password in multiple places to begin with... – ilkkachu May 30 '18 at 21:18
  • @IgnacioVazquez-Abrams that's a shame. Thanks anyway! – brndn2k May 30 '18 at 21:24
  • Look at the Kerberos option, as detailed over at superuser.com/a/1241316/332907. No password required (for the mount). – roaima May 30 '18 at 22:21
  • 1
    You can always create a credential file that only root can read, but I guess from the context you already know that. – Rui F Ribeiro May 31 '18 at 0:20
3

No, you cannot obscure the password. Your computer needs to be able to present the password to the server. This means that whatever means you use to obscure the password, your computer has to be able to take that obscured form and decode it. If your computer can do it, anybody's computer can do it.

The case of EAP is different on the surface because for EAP the client needs to present the NTML hash of the password. But that means that effectively the password is that hash and not the human-readable input. So in fact, even with hash: in the configuration file, the configuration file does contain the password in cleartext.

The tutorial you read is very misleading by implying that hashing the EAP password in the file has a significant security benefit. In fact, it has no benefit at all if you don't use that password for anything else, since as we saw above the effective password is the hash. If the same password is also used for something else (where the server wants the password and not its hash) then there is some benefit, but it's limited because MD4 is quite easy to brute force.

If you don't want to type your password every time, your best bet is to store the password in a password manager and make sure that only you can access the password manager. Make sure that it's encrypted on disk in case someone steals your computer (of course this means that you'll have to decrypt the password container at some point after bootig). But if someone gains access to your computer, they'll gain access to the password. There's no way to prevent that.

If you can influence the server's configuration and want to improve security, consider enabling Kerberos authentication, which if configured thoroughly can let you access network shares using your login password.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.