Mount Windows (CIFS) shares on Linux with credentials in a secure way

 

Posted on 09/09/2014

In almost all cases, when mounting a CIFS-share on a Linux host, you will need to supply some credentials. Either you could enter the credentials by hand every time you need the share or add the credentials to /etc/fstab to automatically mount the share. Entering the password manually is secure but not comfortable, leaving the password in /etc/fstab is comfortable but not secure since the file /etc/fstab is world readable.

Generally, it’s a good idea to password protect shares since you don’t want everyone to freely have access to a share. The “problem” you have with that, if you want to automatically mount the share on your Linux-system, is that the password needs to be saved somewhere or entered manually. For obvious reasons, entering the password every time you need the share isn’t very convenient. Especially not when you want the share to be automatically mounted on boot. This article is about how to avoid manually mounting a Windows share and still keep the credentials secure.

Installing CIFS support

A share created on a Windows-machine can be used on a Linux box by using the CIFS file system. CIFS (Common Internet File System) is a dialect of SMB (Server Message Block).

First thing to do before we are able to use a CIFS-share on our Linux machine is to make sure that it understands how to talk CIFS and thus has support for the CIFS file system.

To check which file systems are supported on your machine:

[jensd@cen ~]$ cat /proc/filesystems

nodev sysfs

nodev rootfs

nodev bdev

nodev proc

nodev cgroup

nodev cpuset

nodev tmpfs

nodev devtmpfs

nodev debugfs

nodev securityfs

nodev sockfs

nodev pipefs

nodev anon_inodefs

nodev configfs

nodev devpts

nodev ramfs

nodev hugetlbfs

nodev autofs

nodev pstore

nodev mqueue

nodev selinuxfs

xfs

nodev rpc_pipefs

nodev nfsd

nodev binfmt_misc

As you can see in the above list, CIFS is not there. This means that we’ll have to install the necessary packages to support CIFS. In case you were wondering (as I did), the nodev option means that such filesystem doesn’t require a block device but can be used as a virtual fs.

To install CIFS-support on RHEL/CentOS/SL and variants:

[jensd@cen ~]$ sudo yum install cifs-utils

...

Complete!

For Debian/Ubuntu/Mint and variants:

jensd@deb:~$ sudo apt-get install cifs-utils

When checking the entries in /proc/filesystems after installation, you should see CIFS:

[jensd@cen ~]$ cat /proc/filesystems |grep cifs

nodev cifs

On some Linux distro’s, filesystems do not appear in /proc/filesystems before the first use, even if it’s installed. In that case you can check which kernel modules are available for filesystems:

To look at the full list:

[jensd@cen ~]$ ls /lib/modules/$(uname -r)/kernel/fs/*/*ko

/lib/modules/3.10.0-123.el7.x86_64/kernel/fs/btrfs/btrfs.ko

/lib/modules/3.10.0-123.el7.x86_64/kernel/fs/cachefiles/cachefiles.ko

/lib/modules/3.10.0-123.el7.x86_64/kernel/fs/cifs/cifs.ko

/lib/modules/3.10.0-123.el7.x86_64/kernel/fs/cramfs/cramfs.ko

/lib/modules/3.10.0-123.el7.x86_64/kernel/fs/dlm/dlm.ko

/lib/modules/3.10.0-123.el7.x86_64/kernel/fs/exofs/libore.ko

/lib/modules/3.10.0-123.el7.x86_64/kernel/fs/ext4/ext4.ko

/lib/modules/3.10.0-123.el7.x86_64/kernel/fs/fat/fat.ko

/lib/modules/3.10.0-123.el7.x86_64/kernel/fs/fat/msdos.ko

/lib/modules/3.10.0-123.el7.x86_64/kernel/fs/fat/vfat.ko

...

To look for CIFS-support:

[jensd@cen ~]$ ls /lib/modules/$(uname -r)/kernel/fs/*/*ko|grep cifs

/lib/modules/3.10.0-123.el7.x86_64/kernel/fs/cifs/cifs.ko

Mount the CIFS share manually

After installing the packages and checking the filesystem support, our system should be able to mount a Windows/CIFS-share. The best way to be sure is simply to mount a CIFS-share:

[jensd@cen ~]$ sudo mount -t cifs //192.168.202.2/drive_e /mnt -o user=jensd

Password for jensd@//192.168.202.2/drive_e: **********

[jensd@cen ~]$ mount

...

//192.168.202.2/drive_e on /mnt type cifs (rw,relatime,vers=1.0,cache=strict,username=jensd,domain=TEST,uid=0,noforceuid,gid=0,noforcegid,addr=192.168.202.2,file_mode=0755,dir_mode=0755,nounix,rsize=61440,wsize=65536,actimeo=1)

As you can see in the above output, we had to enter the password manually when mounting. To avoid entering the password, it is possible, next to the username, to supply the password directly on the command but this means it’s readable by everyone looking at your screen or previously entered commands.

Automatically mount the CIFS share

What we really want is to automatically mount the share on boot. For that, we basically have two options:

• The first option is to create a small script with the above mount-command, including the password, and let it run on boot. The positive thing with this option would be that the script can be protected from being read by other users by changing the permissions. The negative part is that a simple mount or re-mount won’t work anymore since our mountpoint isn’t in /etc/fstab and that this isn’t really considered as a best practice solution.
• The second, and best, option, is to add the mountpoint to /etc/fstab. The only problem we have there is that we will have to find a way to supply the credentials. The file /etc/fstab is readable by everyone, so to put the password directly in /etc/fstab isn’t really a good idea.

To continue with the second option, we’ll provide the credentials required in an external file. The file only contains the required username and password and we can restrict the file to be only readable by root. The fstab-entry contains only the path to the file.

The file providing the credentials which is made only readable by root:

[jensd@cen ~]$ sudo vi /root/.smbcred

[jensd@cen ~]$ sudo cat /root/.smbcred

username=jensd

password=secret

[jensd@cen ~]$ sudo chmod 400 /root/.smbcred

[jensd@cen ~]$ sudo ls -al /root/.smbcred

-r--------. 1 root root 36 Sep 9 15:43 /root/.smbcred

The line to automatically mount the share on boot in /etc/fstab:

[jensd@cen ~]$ cat /etc/fstab|grep /mnt

//192.168.202.2/drive_e /mnt  cifs  credentials=/root/.smbcred  0 0

The line in /etc/fstab consists out of 6 parts:

• the remote location (//192.168.202.2/drive_e)
• the local mountpoint (/mnt)
• the type of filesystem (cifs)
• the options (credentials=/root/.smbcred)
• dump-option (0)
• check/pass-option (0)

After adding the above line, we can simply mount our share without providing credentials. On top of that, the share should be mounted at boot time automatically

[jensd@cen ~]$ sudo mount /mnt/

The above seems to be a simple solution, and it is, but I still see too often that password are simply entered in /etc/fstab or that a “work-around-boot-script” is used in order to prevent other from knowing precious Windows-share passwords.

This entry was posted in CentOS, Debian, Linux, Red Hat, RHEL, Security, Windows by jensd. Bookmark the permalink.