cifscreds(1)

💖 cifscreds — manage NTLM credentials in kernel keyring 💖

okay bestie, welcome to cifscreds(1) — the General Commands Manual entry that's about to be your new fave. no cap, this little tool is lowkey the reason your multiuser CIFS mounts actually work. let's get into it 🫶

---

✨ SYNOPSIS ✨

cifscreds add|clear|clearall|update [-u username] [-d] host|domain
[-t timeout]

---

🌸 DESCRIPTION 🌸

so cifscreds is the program you use to manage credentials (that's username and password, the whole package 💅) so you can establish sessions in multiuser mounts.

here's the vibe: when a cifs filesystem gets mounted with the "multiuser" option, and it's not doing krb5 authentication, it still needs to get the credentials for each user from somewhere. and that somewhere? it's this. cifscreds is literally the tool that hands those credentials over to the kernel. it's giving personal assistant to the kernel, honestly. iconic. 👑

the first non-option argument you give to cifscreds is a command (peep the COMMANDS section below ⬇️). the second non-option argument is a hostname or address, or an NT domain name.

---

🎀 COMMANDS 🎀

• add — add credentials to the kernel, to be used for connecting to the given server, or to servers in the given domain. ✨
• clear — clear credentials for a particular host or domain from the kernel. bye bye 👋
• clearall — clear all cifs credentials from the kernel. total reset, main character energy.
• update — update stored credentials in the kernel with a new username and password. glow-up for your creds 💅

---

🌈 OPTIONS 🌈

• -d, --domain — the host/domain argument you provided is an NT domainname.

ordinarily, the second argument you pass to cifscreds is treated as a hostname or IP address. this option makes the cifscreds program treat that argument as an NT domainname instead.

and here's the tea: if there aren't host-specific credentials for the mounted server, then the kernel will next look for a set of domain credentials equivalent to the domain= option you provided at mount time. so it's got a backup plan, fr fr.

• -u, --username — ordinarily, the username is derived from the unix username of the user adding the credentials. this option lets you substitute a different username. cute little alias moment 💖
• -t, --timeout — sets the key timeout in seconds. if you don't set it, it'll use the system default timeout for logon keys. no rush bestie, but the clock is ticking ⏰

---

⭐ NOTES ⭐

the cifscreds utility requires a kernel built with support for the login key type. that key type was added in v3.3 in mainline Linux kernels. so if you're on something ancient, this is not the moment, sorry 😭

since cifscreds adds keys to the session keyring, it is highly recommended that you use pam_keyinit to make sure a session keyring is established at login time. this one's not optional-feeling, okay? do it. 🫶

---

🦋 SEE ALSO 🦋

• pam_keyinit(8)

---

👑 AUTHORS 👑

the cifscreds program was originally developed by Igor Druzhinin <<jaxbrigs@gmail.com>>. this manpage and a redesign of the code was done by Jeff Layton <<jlayton@samba.org>>. legends, both of them 💜

---

k that's the whole page, bestie — and if you were wondering what that lil cifscreds(1) at the bottom was, that's just the footer doing its thing, the manual name plus its section. the original ran from the cifscreds(1) header right down to that closing cifscreds(1), and now you've got all of it, no crumbs left behind. slay 💅✨