/etc/fstab Mount Options: CIFS Shares, Credentials Files, and Recovering from a Bad Entry

/etc/fstab is the filesystem table that tells Linux what to mount at boot and with which options. Each line has six fields: the device (or network share), the mount point, the filesystem type, a comma-separated option list, a dump flag, and an fsck pass number. For Common Internet File System (CIFS) shares, the critical options are credentials= — which points at a root-only file holding the username and password so they never appear in fstab — plus _netdev and nofail, which stop a network share or a typo from wrecking the boot process.

Anatomy of an fstab line

A local example first:

UUID=3f1c9a2e-...  /data  xfs  defaults,noatime  0  0

Field by field: what to mount (prefer UUID= or LABEL= over /dev/sdb1, since device letters can change between boots), where to mount it, the type (xfs, ext4, cifs, nfs, swap…), the options, the dump field (legacy backup flag, almost always 0), and the pass field controlling fsck order at boot: 1 for the root filesystem, 2 for other local filesystems, 0 to skip — and network filesystems should always use 0, because fsck of a remote share makes no sense.

Options you’ll use constantly: defaults (shorthand for rw,suid,dev,exec,auto,nouser,async), noauto (skip at boot and during mount -a; mount manually only), ro/rw, noexec, nosuid, and x-systemd.automount (mount lazily on first access).

Mounting a Windows share via CIFS

CIFS is the filesystem type Linux uses to mount Server Message Block (SMB) shares — the protocol Windows file servers and NAS devices speak. You need the cifs-utils package installed. A production-quality entry looks like this:

//fileserver01/projects  /mnt/projects  cifs  credentials=/etc/cifs-creds,uid=1000,gid=1000,vers=3.0,_netdev,nofail  0  0

Three parts of that line are the load-bearing skeleton the exam cares about: the cifs filesystem type in field three, the credentials= option pointing at a protected file, and the _netdev option marking it as a network filesystem. The rest tune behavior:

• uid= / gid= — CIFS has no native Unix ownership mapping in the simple case, so these set which local user and group own the mounted files.
• vers=3.0 (or 3.1.1) — pins the SMB protocol dialect. SMB1 is obsolete and insecure; modern kernels negotiate SMB2+/3 by default, but pinning avoids surprises against older servers.
• _netdev — tells systemd this mount needs the network up first, so it’s ordered after network-online instead of being attempted alongside local disks (where it would fail every time).
• nofail — boot continues even if this mount fails. Without it, an unreachable file server can dump your machine into emergency mode.

The credentials file

Never embed username=alice,password=Hunter2 directly in the fstab line. /etc/fstab is world-readable by design — every local user could read those credentials, and they’d also leak into backups and configuration-management diffs. Instead, credentials=/etc/cifs-creds references a separate file with this format:

username=alice
password=Hunter2
domain=CORP

Lock it down so only root can read it:

chown root:root /etc/cifs-creds
chmod 600 /etc/cifs-creds

The mount is performed by root at boot, so root-only permissions cost nothing functionally while keeping secrets out of a world-readable config file. This pattern — secret material split into a tightly-permissioned side file referenced by the main config — recurs all over Linux administration, and the exam expects you to recognize credentials= as its CIFS incarnation.

nofail vs _netdev vs noauto

These three get confused because all of them change when or whether a mount happens, but they solve different problems:

Option	What it changes	Typical use
_netdev	Ordering: wait until the network is up before mounting	Any CIFS/NFS/iSCSI entry
nofail	Consequence: a failed mount no longer blocks boot	Removable media, network shares, any non-essential volume
noauto	Whether: never mounted at boot or by plain mount -a	Backup targets, rarely-used volumes mounted on demand

A robust network-share entry usually carries both _netdev and nofail: the first gives the mount its best chance of succeeding, the second contains the damage if it still can’t.

Recovering from a bad fstab entry

A wrong device path, a dead UUID, or a typo in a non-nofail entry causes the corresponding mount unit to fail at boot, and systemd drops the system into the emergency shell (emergency mode) with the root filesystem mounted read-only. The recovery procedure:

1. At the emergency prompt, enter the root password.
2. Remount root read-write so you can edit files: mount -o remount,rw /
3. Fix (or comment out with #) the broken line in /etc/fstab — brush up on vim commands first if the editor is unfamiliar, since :q! is your escape hatch for a botched edit. Use journalctl -xb to confirm which mount unit failed if it isn’t obvious — see journalctl commands for reading boot logs.
4. Run systemctl daemon-reload so systemd regenerates its mount units from the edited fstab, then test with mount -a — it attempts every non-noauto entry and surfaces errors immediately, without a reboot.
5. Reboot into the normal target.

The two steps candidates forget are the remount,rw (you can’t edit fstab on a read-only root) and testing with mount -a before rebooting. Verifying identifiers with lsblk -f or blkid before writing the entry — for example after creating a new partition with the tools covered in GPT partitioning with gdisk and sgdisk — prevents the whole episode.

How the XK0-006 exam tests this

• A scenario where an admin wants a persistent SMB mount without a plaintext password visible in fstab, asking which option achieves it — testing that you know credentials= and the restricted-permission file it points to.
• A “choose three” construction question asking which components belong in a solid CIFS fstab entry — expecting the cifs type, credentials=, and _netdev (with distractors like an fsck pass of 2, NFS-specific options, or inline password=).
• A boot-failure narrative: a typo’d device path drops the machine into emergency mode, and you must sequence the fix — remount root rw, edit fstab, daemon-reload, verify with mount -a, reboot.
• A behavior-discrimination question separating nofail, _netdev, and noauto — which one keeps boot alive, which one waits for the network, which one skips the mount entirely.

Mount scenarios like these run throughout the System Management domain — the XK0-006 study guide maps the full exam, and the Linux+ practice exam bank puts fstab scenarios in front of you under time pressure.

Quick reference

• fstab fields, in order: device | mount point | type | options | dump | fsck pass. Network filesystems get pass 0.
• Identify devices by UUID= (from blkid/lsblk -f), not /dev/sdX names.
• CIFS share skeleton: //server/share /mnt/x cifs credentials=/etc/cifs-creds,uid=...,vers=3.0,_netdev,nofail 0 0.
• Credentials file: username=/password=/domain= lines, owned root, chmod 600.
• _netdev = wait for network; nofail = don’t block boot on failure; noauto = don’t mount automatically at all.
• Bad entry recovery: emergency shell → mount -o remount,rw / → edit fstab → systemctl daemon-reload → mount -a to test → reboot.
• mount -a mounts everything in fstab not marked noauto — your no-reboot test for fstab correctness.