Domain user with only permission to access file share via Linux box

Question

Most of our computers are running Windows in an Active Directory domain environment. We have a Linux box that pushes data over to a Windows box via a SMB share. The Linux box is setup to mount that share using a domain user. Obviously, this means that the user name and password are being stored the Linux machine (in clear text, in a script I think).

If someone somehow stole that passward, I don't want them to be able do to anything else on the domain like login into a computer or access shares that "domain users" have access to.

Is there any way a I can setup the domain login so that it has basicaly just has no permissions unless they are explicently granted (like write to specific share).

Answer 1

There is no reason any passwords need to be used to stored anywhere, let alone in plaintext. If the the Linux box is using Kerberos via your Active Directory domain, mount.cifs can mount the remote share with sec=krb5 which requires no passwords beyond that needed to login initially.

As for giving a domain login no permissions, no way am I going to help you with that. If you want to be a BOFH, you're on your own. :)