Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Most of our computers are running Windows in an Active Directory domain environment. We have a Linux box that pushes data over to a Windows box via a SMB share. The Linux box is setup to mount that share using a domain user. Obviously, this means that the user name and password are being stored the Linux machine (in clear text, in a script I think).

If someone somehow stole that passward, I don't want them to be able do to anything else on the domain like login into a computer or access shares that "domain users" have access to.

Is there any way a I can setup the domain login so that it has basicaly just has no permissions unless they are explicently granted (like write to specific share).

share|improve this question
add comment

1 Answer

There is no reason any passwords need to be used to stored anywhere, let alone in plaintext. If the the Linux box is using Kerberos via your Active Directory domain, mount.cifs can mount the remote share with sec=krb5 which requires no passwords beyond that needed to login initially.

As for giving a domain login no permissions, no way am I going to help you with that. If you want to be a BOFH, you're on your own. :)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.