I have got the following setup: One linux machine is the backup storage for a whole network of machines. The network is considered save in the sense that no real bad guy is assumed on it. In the network are multiple nodes (
F) that put their backups to the central server (not topic of this question). Each such node is dedicated to exactly one user.
The users should now be allowed to access their own backups. That is on the server there is a folder containing folders
F containing the individual backup destinations. The users on the nodes should be able to access their own backups.
One idea was to use chrooted SSH connections to allow the connection to the individual backup paths. The other idea was to use NFS with kerberos. The IPs are assigned dynamically and cannot be fixed. There no option to change this behavior (see it as a restriction). So I cannot export the shares
F to the IPs as these are not fixed.
Here is my question: Can I somehow restrict the access for some shares to be accessible only via kerberos for a subset of all known machines?
I thought of using different domains but I am unsure if this could work at all. Here I do not have enough insight in kerberos. Could you please give me advice before I mess with the whole network and in the end I do not reach anything useful.