I need to pull some data from network storage to a publicly available laptop that is running Linux. The network storage used to be provided via a server that could be connected to via ssh, but it has now been switched to a server that only provides access via samba. I used to connect from the laptop to the server with SSH keys and I sand boxed the key on the server to only run rsync to make it more difficult for the compromised laptop (it is publicly available after all) to limit the damage (or at least make it more difficult) to damage/compromise the server. It probably would have been better to push from the server to the laptop but the IP address changes depending on where it is used and I frequently couldn't get through the firewall the laptop was behind (it is used in peoples homes).
I asked IS how I should implement the data sync on the new system. There response was to store my password in plain text on the publicly available laptop and use that to mount the samba share. There comment to me was:
I would suggest that storing a plain text password on your machine is no more "dangerous" than storing both of your public/private SSH keys on the same disk. Anyone who "roots" your machine can log keystrokes to learn passwords in either case.
I am pretty sure this advice is just wrong. I work at a university and we use a single log on active directory set up. With the SSH key someone can get access to a single service on a single server, while my password will give them access to "everything". Is there a way to securely mount a samba share without making my password available? For example, maybe setting up a (virtual) server that acts as a go between.
A second, and decidedly softer, question is, is the advice about plain text passwords so bad I should report the IS person, who is on the file storage team, to someone on the IS security team?