HBAC Rule to allow anonymous NFS mounts from specific subnets

[White, David]

Is it possible to allow hosts in specific subnets to connect to a FreeIPA-connected server over NFS anonymously? 
e.g. I'm wondering if I could setup a HBAC rule by doing something like the following:

ipa hbacsvc-add nfs-mount
ipahbacrule-add allow_nfs_mount

Then attach that to the NFS server
And then allow "anyone" to connect over NFS to that server

Bonus points if there's a way to restrict the source NFS connection by IP address or subnet

Is this possible?

[Alexander Bokovoy]

On ke, 29 huhti 2020, White, David via FreeIPA-users wrote:
> Is it possible to allow hosts in specific subnets to connect to a FreeIPA-connected server over NFS anonymously?
> e.g. I'm wondering if I could setup a HBAC rule by doing something like the following:
>
> ipa hbacsvc-add nfs-mount
> ipahbacrule-add allow_nfs_mount
>
> Then attach that to the NFS server
> And then allow "anyone" to connect over NFS to that server

HBAC rules apply in PAM through use of pam_sss module. NFS servers do
not use PAM authentication, so your chances to apply HBAC rules are not
there.
> Bonus points if there's a way to restrict the source NFS connection by IP address or subnet

You need to look into your firewall setup.