Re:The Unix-Haters Handbook [pdf]
by kiney on Wednesday April 24, 2024 @06:59AM
(#40142875)
in most cases you can just use more fine-grained exports.
e.g. export /home/user1 to 10.0.0.1 and /home/user2 to 10.0.0.2 instead of /home to 10.0.0.0/24 etc.
With Kerberos a hacked client where user 1 has authenticated can't impersonate user 2 unless that user has also authenticated on the client.
With sec=sys the client is simply trusted without any per-user authentication.