Hardening NFS exports: network scope, squash options and sec=krb5 instead of AUTH_SYS

Goal

Reduce what an NFS export trusts from its clients: which hosts may connect, which UID/GID a request is allowed to claim, and whether the server can require cryptographic proof of identity instead of taking the client's word for it.

Prerequisites

An existing export in /etc/exports; for the Kerberos option, a working Kerberos realm, an nfs/<fqdn> key in the server's keytab, gssproxy (or the older rpc.svcgssd) on the server and rpc.gssd on clients, which is outside this article's scope.

Steps

1. Never export to every host. exports(5) lets an export target a single host, a name pattern, or a whole subnet as address/netmask; scope each export to the smallest network that needs it.
2. Keep root_squash (the default): the option maps requests from uid/gid 0 to the anonymous uid/gid, so a client claiming to be root does not get root on the server's files. It does not stop a client's root from switching to any other UID and acting as that user. Remove it (no_root_squash) only for a specific, trusted management host that genuinely needs it.
3. For exports where no client-supplied UID should be trusted at all — a shared drop directory, for example — use all_squash so every request is mapped to the anonymous account regardless of the UID it presents.
4. Understand why this matters: nfs(5)'s security considerations state that NFS servers control access to file data but depend on their RPC implementation for authentication, and the traditional implementation represents each user by a plain number the client itself supplies — the server does not independently verify it.
5. Where the data justifies it, move the export and the client mount to sec=krb5 (authentication only), krb5i (plus integrity) or krb5p (plus encryption). nfs(5) documents sec= as a colon-separated list of one or more security flavors to use for accessing files on the mount, with krb5, krb5i and krb5p among the valid flavours; the export line takes a matching sec= option to require it.
6. Re-export with exportfs -ra and confirm the flavour a client actually negotiated by checking the mount's options on the client (cat /proc/mounts or nfsstat -m).

Expected result

Mounts from outside the configured network are refused; a client presenting UID 0 is mapped to the anonymous account on squashed exports; where the export lists only sec=krb5* flavours, access without valid Kerberos credentials is refused (at mount time or on first access) instead of falling back to AUTH_SYS.

Limits and test basis

AUTH_SYS gives every user on every allowed client the access that UID implies; root_squash addresses only root, and all_squash fits only exports where no per-user ownership is needed. Kerberized NFS depends on correct time synchronisation and a properly maintained keytab — a broken KDC breaks mounts rather than degrading silently, so test changes in a maintenance window. Keep a copy of the previous /etc/exports before tightening it.