How to Configure NFSv4 with Kerberos for Secure File Sharing on Ubuntu

Traditional Network File System version 3 (NFSv3) deployments rely on client-side IP authentication and unauthenticated user IDs (UIDs), permitting any root user on a compromised client to spoof arbitrary user credentials over the network. In contrast, NFSv4 eliminates legacy portmapper daemons, operates across a single stateful TCP port 2049, and integrates natively with Kerberos (GSS-API). Configuring NFSv4 with Kerberos security (sec=krb5p) enforces mutual cryptographic identity verification and full packet payload encryption across enterprise Ubuntu storage networks.

Understanding Kerberos Security Flavors in NFSv4

When mounting an NFS export with Kerberos, administrators can select from three cryptographic security levels:

• krb5: Provides cryptographic authentication only. User identities are verified via Kerberos tickets, but file data transmits across the wire in plaintext.
• krb5i: Enforces cryptographic authentication and data integrity. Digital checksums ensure network packets cannot be tampered with in transit.
• krb5p: Provides full privacy. Enforces cryptographic authentication, packet integrity, and end-to-end AES-256 encryption for all data packets transmitted between server and client.

Installing NFS and Kerberos Server Components

Install the required packages on your Ubuntu NFS storage server:

sudo apt update
sudo apt install nfs-kernel-server krb5-user -y

Ensure the system is enrolled in your realm (such as an Active Directory domain or MIT Kerberos KDC) and generate the host and service principals in your keytab:

# Verify service principal in /etc/krb5.keytab
sudo klist -k -t /etc/krb5.keytab

The keytab must contain valid keys for nfs/[email protected].

Configuring the NFSv4 Domain and Exports

NFSv4 uses the idmapd daemon to map local UIDs to fully qualified domain usernames. Edit /etc/idmapd.conf:

sudo nano /etc/idmapd.conf

Set your administrative domain:

[General]
Verbosity = 0
Pipefs-Directory = /run/rpc_pipefs
Domain = yourdomain.com

Define an export directory and grant access restricted to Kerberos privacy:

sudo mkdir -p /srv/nfs4/secure_data
sudo nano /etc/exports

Append the export policy:

/srv/nfs4        192.168.10.0/24(ro,fsid=0,sec=krb5p,root_squash)
/srv/nfs4/secure_data 192.168.10.0/24(rw,nohide,sec=krb5p,root_squash)

Apply the exports and restart the storage service:

sudo exportfs -rav
sudo systemctl restart nfs-kernel-server

Configuring Client Workstations and Mounting Exports

On client Ubuntu nodes, install user tools and enable the GSS security daemon:

sudo apt update
sudo apt install nfs-common krb5-user -y

# Enable and start rpc-gssd
sudo systemctl enable --now rpc-gssd.service

Mount the Kerberized export from the client terminal:

sudo mkdir -p /mnt/secure_share
sudo mount -t nfs4 -o sec=krb5p storage.yourdomain.com:/secure_data /mnt/secure_share

Obtaining Kerberos Tickets and Validating Access

Because NFSv4 with Kerberos verifies credentials at the per-user level, users must possess active Kerberos Ticket Granting Tickets (TGT) to access directory contents:

# Obtain user ticket from KDC
kinit username

# Inspect active ticket session
klist

# Read and write to the mount
touch /mnt/secure_share/test_file.txt

If a user attempts reading files without an active Kerberos ticket, the Linux kernel rejects access with Permission denied, guaranteeing complete data confidentiality across untrusted networks.