Mount Windows (CIFS) shares on Linux with credentials in a secure way

In almost all cases, when mounting a CIFS-share on a Linux host, you will need to supply some credentials. Either you could enter the credentials by hand every time you need the share or add the credentials to /etc/fstab to automatically mount the share. Entering the password manually is secure but not comfortable, leaving the password in /etc/fstab is comfortable but not secure since the file /etc/fstab is world readable.

Generally, it’s a good idea to password protect shares since you don’t want everyone to freely have access to a share. The “problem” you have with that, if you want to automatically mount the share on your Linux-system, is that the password needs to be saved somewhere or entered manually. For obvious reasons, entering the password every time you need the share isn’t very convenient. Especially not when you want the share to be automatically mounted on boot. This article is about how to avoid manually mounting a Windows share and still keep the credentials secure.

Installing CIFS support

A share created on a Windows-machine can be used on a Linux box by using the CIFS file system. CIFS (Common Internet File System) is a dialect of SMB (Server Message Block).

First thing to do before we are able to use a CIFS-share on our Linux machine is to make sure that it understands how to talk CIFS and thus has support for the CIFS file system.

To check which file systems are supported on your machine:

As you can see in the above list, CIFS is not there. This means that we’ll have to install the necessary packages to support CIFS. In case you were wondering (as I did), the nodev option means that such filesystem doesn’t require a block device but can be used as a virtual fs.

To install CIFS-support on RHEL/CentOS/SL and variants:

For Debian/Ubuntu/Mint and variants:

When checking the entries in /proc/filesystems after installation, you should see CIFS:

On some Linux distro’s, filesystems do not appear in /proc/filesystems before the first use, even if it’s installed. In that case you can check which kernel modules are available for filesystems:

To look at the full list:

To look for CIFS-support:

Mount the CIFS share manually

After installing the packages and checking the filesystem support, our system should be able to mount a Windows/CIFS-share. The best way to be sure is simply to mount a CIFS-share:

As you can see in the above output, we had to enter the password manually when mounting. To avoid entering the password, it is possible, next to the username, to supply the password directly on the command but this means it’s readable by everyone looking at your screen or previously entered commands.

Automatically mount the CIFS share

What we really want is to automatically mount the share on boot. For that, we basically have two options:

  • The first option is to create a small script with the above mount-command, including the password, and let it run on boot. The positive thing with this option would be that the script can be protected from being read by other users by changing the permissions. The negative part is that a simple mount or re-mount won’t work anymore since our mountpoint isn’t in /etc/fstab and that this isn’t really considered as a best practice solution.
  • The second, and best, option, is to add the mountpoint to /etc/fstab. The only problem we have there is that we will have to find a way to supply the credentials. The file /etc/fstab is readable by everyone, so to put the password directly in /etc/fstab isn’t really a good idea.

To continue with the second option, we’ll provide the credentials required in an external file. The file only contains the required username and password and we can restrict the file to be only readable by root. The fstab-entry contains only the path to the file.

The file providing the credentials which is made only readable by root:

The line to automatically mount the share on boot in /etc/fstab:

The line in /etc/fstab consists out of 6 parts:

  • the remote location (//192.168.202.2/drive_e)
  • the local mountpoint (/mnt)
  • the type of filesystem (cifs)
  • the options (credentials=/root/.smbcred)
  • dump-option (0)
  • check/pass-option (0)

After adding the above line, we can simply mount our share without providing credentials. On top of that, the share should be mounted at boot time automatically

The above seems to be a simple solution, and it is, but I still see too often that password are simply entered in /etc/fstab or that a “work-around-boot-script” is used in order to prevent other from knowing precious Windows-share passwords.

6 thoughts on “Mount Windows (CIFS) shares on Linux with credentials in a secure way

    • /etc/fstab has to be world readable so all users on the system can see the password. A separate file containing the password can be secured and unreadable for other users.

      • “Hello World” has a point. Best security practice is to never put plaintext passwords in a file. Even if a plaintext password is stored in a file that other users cannot read, it is still vulnerable to being stolen if someone gains access to the user’s account. Using the credentials file is better than /etc/fstab, but not ideal.

  1. The credentials only readable by root can be read by anyone with sudo. How do I prevent reading by anyone with sudo?

  2. I use the credentials file, and mount manually after boot. Just comment out and clear the password parameter in credentials (# password=) and mount will prompt you for only the password, but not the username and domain. On occasions where I need to automount, say for other users, I can put the password back and change the parameter to auto in fstab. I have a sudo script that asks for the password and changes the two files back and forth. It ain’t pretty but it’s a wee little bit more secure, can survive a reboot when I’m not around, and doesn’t take too long to set up. But this really is a security hole in the OS if you have the password in the file unencrypted. OK for me because my antique NAS can’t handle encrypted passwords anyway. Seems like fstab/mount could use a special named account for this type of thing and pass the password to the NAS in whatever flavor (encrypted or not) it needed it. Hopefully new NASes are more graceful than mine.

Leave a Reply

Your email address will not be published. Required fields are marked *