Secure Access to NFS Share?

Question

Is it safe to use an NFS share as the root of a web directory on another server? Under this config, multiple users would place their files on the NFS (not the web server).

How would you go about securing permissions to keep users from tampering with each others' data?

Answer 1

You need to fully secure all the NFS clients. NFS' security model relies on being able to trust the clients to manage UIDs and access control. There's a minimal amount of root-level security in root_squash, but any non-root user is fair game for an NFS client to abuse if they have a mind to do so.

Once you have got NFS clients you can trust, the problem is the same as any other "multi-user web hosting" scenario -- a set of permissions that provide appropriate access controls to read and write files as required by the operational requirements of the system.