Securely Mounting Samba / CIFS file systems in CentOS 5.6

14.27pm. Earlier I wrote a blog post on how to mount a cifs share in CentOS however I was made aware by a reader that any user on the machine would be able to view the /etc/fstab file and view the credentials inside. This is obviously not ideal, so after a little reading I discovered that I can instead link to a file containing the credentials from /etc/fstab. This credentials file could then be locked down so only root can view it.

Firstly I created a new file in /etc/

touch /etc/COMPUTERHOSTNAME-cifs.credentials

Populate the file with the username and password as required:

username=DOMAIN\USERNAME
password=PASSWORD

chmod the file to 700 so only root can read, write, and execute the file.

chmod 700 /etc/COMPUTERHOSTNAME-cifs.credentials

Finally update your /etc/fstab to read the credentials file:

//SERVERNAME/SHARE /mnt/MOUNTPOINT/ cifs credentials=/etc/COMPUTERHOSTNAME-cifs.credentials 0 0

Once again check the fstab works as expected, umount the cifs mount, and re-running:

mount -a

We can also test viewing the file as a normal user, to ensure the credentials are hidden:

[user@HOSTNAME NormalUser]$ cat /etc/COMPUTERHOSTNAME-cifs.credentials
cat: /etc/COMPUTERHOSTNAME-cifs.credentials: Permission denied

Bingo!

Update: 6-11-2012
Last week I wrote this article to mount a cifs share securely however today I was required to mount a cifs share (which happened to be their ActiveDirectory home drive) to the users home folder on Linux. Using the instructions above I was able to mount the home drive, however I was then unable to access the mount as a normal user. I resolved this by using the following line in the /etc/fstab file:

//SERVER/SHARE /home/USER/Home-Drive/ cifs credentials=/home/user/domain.credentials,file_mode=0770,dir_mode=0770,uid=X,gid=X 0 0

I was able to ascertain the users uid and gid by grabbing the output of "id" as the user. I also created the mount point folder in preperation

sudo su - AnotherUser
id
mkdir ~/Home-Drive

As root I could then run 'mount -a'. This solution does have its flaws as the users password will eventually expire, this in turn will require the credentials file to be updated. The user will also have to either reboot the machine or ask the root user to perform any remount when required.

Update: 25-02-2014
Another scenario would be to use a service account rather then a specific user account to mount the share. These service accounts are usually locked down to ensure they cannot be used outside their desired role.

fstab entry:
//serverName/Share$     /mnt/ShareName     cifs    ro,credentials=/root/.cifs.credentials 0 0

credentials file (chmod 700):
username=domain\lb-slp-en-grp02-cifs
password=password

On the Windows Server I then need to give this user RO access. This can be performed by locating the share under the shares management tool (Computer Management -> Shared Folders -> Shares). Locate the 'Security' tab found under the properties for the share and add the cifs user found above.