Hello,
Im trying to setup a multiuser environment booting from network.
The system is self distro based on Ubuntu debootstrap
I want to use nfs 4 with Kerberos to make the client machines authenticated so I'll know who is mounting the system.
I also want only the home folder of the user to be mounted so he wont be able to read the other home folders of other users and that way I can make sure that even if the system will be exploited and the user will get root access he will not get access to the entire file system.

I was thinking of doing this inside the initramfs, before mounting the file system I will get the Kerberos principal ticket and then mount the root file system as read only, using a keytab, and the user's home folder with the principal Kerberos ticket that I just obtained.

The problem, I cant figure out how to make the NFS export line to allow mounting only with a principal. Is there anyone who managed to use the netgroups that way? Or any other way to do that?
I think exports is ignoring the second and third fields of the netgroup file so they only take the host name from it

from the exports man:
“NIS netgroups may be given as @group. Only the host part of each netgroup members is consider in checking for membership. Empty host parts or those containing a single dash (-) are ignored.”

But then there is no other way to do that?

Thank you for the help.

How are you exporting the shares?

I use autofs (auto_home/auto.home) to mount the user home directories once they are authenticated by kerberos.

Indeed, nfs exports is not the way to go. You can limit acces to a group, but you can not limit access to the users home dir, hence, all users get access to everybodies home dir. That is not what you want I guess.

Through autofs, you can make, on the user side, automount his/hers specific home dir. Google something like "linux automount home dir" and find the auto.master auto.homedir config file. Especially the line in the config file ending with an "&" does the trick.