Imagine this scenario in a LAN: one Linux NFS fileserver (srv) and three Linux clients (A, B, C). There are files / directories on srv with root ownership and no access rights granted to non-root users. Those are the files this question is concerned with. I'll call them "root-restricted files".
A is the local sysadmin. He or she will need to access root-restricted files on srv freely.
B is a local developer who has sudo rights on his or her machine. However, B should not be able to read or write (or traverse) root-restricted files/directories on server. In fact, B should also not be able to access files on srv not owned by groups B belongs to, even though B has sudo rights.
C is a local user with no sudo rights. C should have access to normal files on srv, but no permissions to local or server root-restricted files.
srv at 192.168.1.1
A at 192.168.1.2
B at 192.168.1.3
C at 192.168.1.4
Would this /etc/exports accomplish the goals?
/srv/nfs 192.168.1.2(rw,no_root_squash) /srv/nfs 192.168.1.3(rw,root_squash) /srv/nfs 192.168.1.4(rw,root_squash)
Which other NFS options are recommended? But most importantly, is root_squash capable of achieving this solution if we assume the IP address cannot be not spoofed?
Next, assuming a developer with sudo rights on their machine could spoof their IP address and look like 192.168.1.2, which has no_root_squah, what solution is needed? LDAP + Kerberos? Something else?
Can our goal be accomplished with NFS at all? Is something like SSHFS or Samba 4 a better solution?
(Editing suggestions welcome if "root-restricted files" is not the best term.)