Accessing KRB5 NFS from local system accounts
I recently noticed that spamassassin (running as the local "daemon"
account) will hang some of the time when processing messages, and
tracked it to the process attempting to access
~user/.spamassassin/user_prefs. I believe that should return an access
failure, but sometimes the process stalls instead.
In any case, I'd like to allow access, but my understanding is that
processes without a Kerberos ticket cannot access an NFS4 filesystem
with sec=krb5. Is that correct? If so, how would I allow a local
system account to access globally readable files? Should I create a
keytab, and set KRB5_KTNAME in the spamassassin environment?
Does anyone working with NFS and krb5 have any tips?