1

I am wondering what options are for using centralized authentication and access to user home directories from any Linux machine while keeping the privacy of the home directories.

Now I am facing a setup of NIS with NFS shares where anyone having root access to one of the machines can get read access to all users home directories.

What setup would prevent this from happening? I am also open to suggestions that would involve AD because we are running in a mixed environment.

Requirements

  • Users must be able to have root access on some of the machines
  • Users should not be able to get read access to others home directories.

2 Answers 2

2

NFS allows to export shares with the option root_squash. This maps root to the user nobody. This let your users be root on the local machine but not access files on the shares as root.

However, if you are root on a local machine, you can impersonate anybody (create a new user with an UID of your choice, change local passwords, etc.). There is no way to keep somebody out this way.

0

Brush up on the use of umask, file/folder permissions, possible use of sudo (local per user elevated privileges) or if you wish to use AD a combination of PAM modules supporting NIS, KRB5 and LDAP

2
  • Restricting root user access to these boxes is not an option, we are talking about development machines which do have to "suffer" from very weird modifications.
    – sorin
    Sep 3, 2015 at 10:42
  • 1
    I don't think my answer mentioned disabling anything.
    – jas-
    Sep 3, 2015 at 10:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .