1

I need to pull some data from network storage to a publicly available laptop that is running Linux. The network storage used to be provided via a server that could be connected to via ssh, but it has now been switched to a server that only provides access via samba. I used to connect from the laptop to the server with SSH keys and I sand boxed the key on the server to only run rsync to make it more difficult for the compromised laptop (it is publicly available after all) to limit the damage (or at least make it more difficult) to damage/compromise the server. It probably would have been better to push from the server to the laptop but the IP address changes depending on where it is used and I frequently couldn't get through the firewall the laptop was behind (it is used in peoples homes).

I asked IS how I should implement the data sync on the new system. There response was to store my password in plain text on the publicly available laptop and use that to mount the samba share. There comment to me was:

I would suggest that storing a plain text password on your machine is no more "dangerous" than storing both of your public/private SSH keys on the same disk. Anyone who "roots" your machine can log keystrokes to learn passwords in either case.

I am pretty sure this advice is just wrong. I work at a university and we use a single log on active directory set up. With the SSH key someone can get access to a single service on a single server, while my password will give them access to "everything". Is there a way to securely mount a samba share without making my password available? For example, maybe setting up a (virtual) server that acts as a go between.

A second, and decidedly softer, question is, is the advice about plain text passwords so bad I should report the IS person, who is on the file storage team, to someone on the IS security team?

3

They're quite correct. If you store credentials on the laptop and the bad guy compromises it, the bad guy gets those credentials, end of story.

Counter-intuitive as it sounds, plain text is the correct way to store credentials in this set-up. It is pointless to encrypt them, because the laptop has to be able to decrypt them, so you have to put the decryption key on the laptop and you're back where you started, except you've added pointless complexity. (Interestingly, this is why DRM systems invariably turn out to be snake oil. Doesn't matter how you encrypt a movie, you have to give the end user the key to decrypt it before they can watch it.)

Where you've got a problem with the new set-up is that you're proposing to use your personal credentials to access the storage. You need to have a separate set of credentials, just for this purpose, that are locked down so that they can only access the specific share.

  • But doesn't using ssh keys essentially allow me to lock down the credentials since it only allows the credential to run a single command on a single server? Since they won't give me a second set of credentials, shouldn't I be able to go through an intermediary server to lock down the credential? – StrongBad Jul 31 '14 at 12:51
  • 1
    Exactly, yes. The credentials on the laptop are not safe, whether they are keys or passwords, so you have to lock them down at the server level so they can't do anything. If they won't give you a second set of credentials or offer a better solution then you should go to the security team and ask them how you're supposed to proceed. – Graham Hill Aug 1 '14 at 11:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.