Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Most of our computers are running Windows in an Active Directory domain environment. We have a Linux box that pushes data over to a Windows box via a SMB share. The Linux box is setup to mount that share using a domain user. Obviously, this means that the user name and password are being stored the Linux machine (in clear text, in a script I think).

If someone somehow stole that passward, I don't want them to be able do to anything else on the domain like login into a computer or access shares that "domain users" have access to.

Is there any way a I can setup the domain login so that it has basicaly just has no permissions unless they are explicently granted (like write to specific share).

share|improve this question

There is no reason any passwords need to be used to stored anywhere, let alone in plaintext. If the the Linux box is using Kerberos via your Active Directory domain, mount.cifs can mount the remote share with sec=krb5 which requires no passwords beyond that needed to login initially.

As for giving a domain login no permissions, no way am I going to help you with that. If you want to be a BOFH, you're on your own. :)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.