Secure automatic authentication to samba share

Question

I need to pull some data from network storage to a publicly available laptop that is running Linux. The network storage used to be provided via a server that could be connected to via ssh, but it has now been switched to a server that only provides access via samba. I used to connect from the laptop to the server with SSH keys and I sand boxed the key on the server to only run rsync to make it more difficult for the compromised laptop (it is publicly available after all) to limit the damage (or at least make it more difficult) to damage/compromise the server. It probably would have been better to push from the server to the laptop but the IP address changes depending on where it is used and I frequently couldn't get through the firewall the laptop was behind (it is used in peoples homes).

I asked IS how I should implement the data sync on the new system. There response was to store my password in plain text on the publicly available laptop and use that to mount the samba share. There comment to me was:

I would suggest that storing a plain text password on your machine is no more "dangerous" than storing both of your public/private SSH keys on the same disk. Anyone who "roots" your machine can log keystrokes to learn passwords in either case.

I am pretty sure this advice is just wrong. I work at a university and we use a single log on active directory set up. With the SSH key someone can get access to a single service on a single server, while my password will give them access to "everything". Is there a way to securely mount a samba share without making my password available? For example, maybe setting up a (virtual) server that acts as a go between.

A second, and decidedly softer, question is, is the advice about plain text passwords so bad I should report the IS person, who is on the file storage team, to someone on the IS security team?

Answer 1

They're quite correct. If you store credentials on the laptop and the bad guy compromises it, the bad guy gets those credentials, end of story.

Counter-intuitive as it sounds, plain text is the correct way to store credentials in this set-up. It is pointless to encrypt them, because the laptop has to be able to decrypt them, so you have to put the decryption key on the laptop and you're back where you started, except you've added pointless complexity. (Interestingly, this is why DRM systems invariably turn out to be snake oil. Doesn't matter how you encrypt a movie, you have to give the end user the key to decrypt it before they can watch it.)

Where you've got a problem with the new set-up is that you're proposing to use your personal credentials to access the storage. You need to have a separate set of credentials, just for this purpose, that are locked down so that they can only access the specific share.