0

I have a home network with wifi that is password protected. On my home network, I have a file server with a password protected Samba share. The share itself is protected because my network has multiple machines with multiple users and I want to make sure only I can access this share from whatever machine I'm using at the time (sorry for stating the obvious, but I want to head off responses of, "You're on a home network and your wifi is already pw protected, so why do you need pw protection for the share itself?" etc).

Currently, this is how I mount my Samba shares (note, the part that's relevant to my question is sec=ntlm):

mount -t cifs //myserver/myshare /media/myshare -o uid=myunixuser,gid=myunixgroup,credentials=/home/myunixuser/.smbcredentials,iocharset=utf8,sec=ntlm,file_mode=0600,dir_mode=0700

So far, so good; however, I've read several articles about security types and why NTLM is not recommended, yada yada (see article "NTLM’s time has passed"). I've googled "ntlm vs ntlmv2 vs kerberos" and tried to learn more by reading the Wikipedia article about NTLM and the Ubuntu man page on this topic, but it's not quite registering for me.

I feel like most documentation out there is intended for network admins, and I'm more of a weekend warrior. In general, I gather that NTLMv2 is preferred to NTLM, same with Kerberos, but that doesn't mean I should automatically choose v2 or Kerberos because not all clients support them. Sooo, what the heck? Can anyone dumb it down for me? Even if I stick with NTLM, I just want to understand what's the deal with these different security options. Please let me know if I'm thinking too hard about this. Thanks.

1

Windows clients support all three, as do recent Linux kernels. I don't know of any modern client that does not support NTLMv2, although Kerberos is slightly less common.

The major difference between NTLM and Kerberos is:

  • NTLM is a challenge-response mechanism that works with just passwords. So it can be used between any two hosts as long as the client knows the password that the server wants.

  • Kerberos is ticket-based; the client gets a login ticket from a central KDC and presents it to the server. This needs a Kerberos realm to be set up – in case of CIFS it's usually an Active Directory domain – and the realm's KDC hosted somewhere.

    (Mac OS X – which used to prefer the AFP protocol over CIFS – actually manages to use Kerberos between two peers, using autogenerated realm names, but neither Windows nor Linux support the same.)

However:

  • The security of NTLM version 1 is very close to that of just sending the password in plain. NTLMv2 improves this somewhat, although I'm not sure how much.

  • Meanwhile, Kerberos 5 is considered very secure, and is used by Active Directory, FreeIPA, and various other Unix directory service software.

Unfortunately, Kerberos takes some time to set up, and Windows clients only support it properly (i.e. without spending 3 days) when both the client and server belong to an AD domain.

Soo you will have to choose NTLMv2 for now. It's what standalone Windows machines use by default, anyway. (The default in modern Linux kernels is sec=ntlmssp; I am not entirely sure how it differs from ntlmv2, though I know the differences do not have any security impact.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.