Is there any chance to secure NFS so it can authenticate mount requests more than by IP address? Of course I am aware that NFS by design does not allow it but I think of any wrapper for it or may be any other solution to mount home directories on multiple machines in single subnet environment, where I can not be sure someone does not spoof IP address.
2 Answers
You can use Kerberos.
When using NFS without kerberos the security of all data in the NFS share depends on the integrity of all clients and the security of the network connections. If you use kerberos the security doesn't depend on all client machines because the server gives access to users with a valid kerberos ticket only.
answered Dec 21, 2012 at 13:42
-
Thanks for this answer! Seems to solve the problem in some way. Nevertheless I would be more satisfied with solution based thoroughly on open source.– MikeDec 24, 2012 at 12:47
This is probably the best answer to my question: http://wiki.debian.org/NFS/Kerberos