Recently I was successful in setting up a NFS v4 server with Kerberos authentication against FreeIPA.Now, I want a host to write data to a share, but the situation is not as straightforward as I expected:The host runs ZoneMinder, which is preconfigured to use the local apache:apache user / groupIn FreeIPA, I created a user named zm_service. After su-ing to zm_service, I am able to write to the NFS shareThe share permissions are zm_service:adminsObviously, ZoneMinder running under user apache is not able to write to the share.My first attempt was to change the ZoneMinder configuration so that ZM runs as zm_service user, but this was unsuccessful (because zoneminder had some permissions issues somewhere).Despite of being unsuccessful, this approach seems non-optimal to me - I don't want to change all services I am running to a FreeIPA-user (maybe I should?).The other approach involved using bind-mount (this is required by ZM to re-locate the data directory) as described here:https://wiki.zoneminder.com/Using_a_dedicated_Hard_DriveThis approach isn't working, too, as mounting the NFS mountpoint via bind seems to inherit the NFS share permissions (which shouldn't suprise me either).Now, I am out of ideas - how can I use the advantages of secure NFS with local service accounts?
Kerberized NFS v4 - grant write access to local service account
nfs;kerberos;bind mount