{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-084-specify-the-nfs-kerberos-protection-mode-in-an-azure-netapp-files-mount-review/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260917-084-specify-the-nfs-kerberos-protection-mode-in-an-azure-netapp-files-mount-review/",
        "slug": "dse-20260917-084-specify-the-nfs-kerberos-protection-mode-in-an-azure-netapp-files-mount-review",
        "url": "https://update.dsesecurity.com/updates/dse-20260917-084-specify-the-nfs-kerberos-protection-mode-in-an-azure-netapp-files-mount-review/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260917-084-specify-the-nfs-kerberos-protection-mode-in-an-azure-netapp-files-mount-review.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-084-specify-the-nfs-kerberos-protection-mode-in-an-azure-netapp-files-mount-review/"
        },
        "title": "Specify the NFS Kerberos protection mode in an Azure NetApp Files mount review",
        "summary": "DSE recommends having the data owner define the required authentication, integrity, and traffic-protection outcome before the mount is approved.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "managed-it",
            "label": "Managed IT operations",
            "alt": "A controlled technology lifecycle progressing from assessment to approved production.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-17T16:33:36+00:00",
        "modified_at": "2026-09-17T16:38:45+00:00",
        "reviewed_on": "2026-09-17",
        "reading_minutes": 1,
        "word_count": 207,
        "potentially_affected": "This guide is for a team reviewing an NFS mount to Azure NetApp Files where the required protection must be stated more precisely than simply saying Kerberos is enabled.",
        "dse_recommendation": "DSE recommends having the data owner define the required authentication, integrity, and traffic-protection outcome before the mount is approved.",
        "primary_source": {
            "name": "Understand Kerberos in Azure NetApp Files | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/azure/azure-netapp-files/kerberos",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Microsoft distinguishes Kerberos authentication with krb5, integrity checking with krb5i, and encryption of the complete NFS conversation with krb5p. For NFS, the security mode is specified in the volume export-policy rule and in the client’s sec mount option. <a href=\"https://learn.microsoft.com/en-us/azure/azure-netapp-files/kerberos\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a></p>\n<h2>Applicability</h2>\n<p>This guide is for a team reviewing an NFS mount to Azure NetApp Files where the required protection must be stated more precisely than simply saying Kerberos is enabled.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends having the data owner define the required authentication, integrity, and traffic-protection outcome before the mount is approved. Record the selected mode beside the export-policy rule and client mount configuration. Ask the application owner to include representative workload behavior in the test plan, especially when selecting the mode with the additional encryption work. Keep protocol and mode choices explicit in the handoff to the Linux and storage teams.</p>\n<h2>Verification</h2>\n<p>Inspect the active client mount and corresponding export policy, then compare both with the agreed mode. Perform the authorized file-access test and record the workload observations. Investigate a mismatch or performance concern before changing the policy, and preserve the chosen protection requirement as the acceptance criterion throughout the review.</p>\n<h2>Official references</h2>\n<ul>\n<li><a href=\"https://learn.microsoft.com/en-us/azure/azure-netapp-files/kerberos\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft: Understand Kerberos in Azure NetApp Files | Microsoft Learn</a></li>\n</ul>",
        "content_text": "Source facts\nMicrosoft distinguishes Kerberos authentication with krb5, integrity checking with krb5i, and encryption of the complete NFS conversation with krb5p. For NFS, the security mode is specified in the volume export-policy rule and in the client’s sec mount option. Microsoft Learn\nApplicability\nThis guide is for a team reviewing an NFS mount to Azure NetApp Files where the required protection must be stated more precisely than simply saying Kerberos is enabled.\nDSE recommendation\nDSE recommends having the data owner define the required authentication, integrity, and traffic-protection outcome before the mount is approved. Record the selected mode beside the export-policy rule and client mount configuration. Ask the application owner to include representative workload behavior in the test plan, especially when selecting the mode with the additional encryption work. Keep protocol and mode choices explicit in the handoff to the Linux and storage teams.\nVerification\nInspect the active client mount and corresponding export policy, then compare both with the agreed mode. Perform the authorized file-access test and record the workload observations. Investigate a mismatch or performance concern before changing the policy, and preserve the chosen protection requirement as the acceptance criterion throughout the review.\nOfficial references\n\nMicrosoft: Understand Kerberos in Azure NetApp Files | Microsoft Learn",
        "content_markdown": "## Source facts\n\nMicrosoft distinguishes Kerberos authentication with krb5, integrity checking with krb5i, and encryption of the complete NFS conversation with krb5p. For NFS, the security mode is specified in the volume export-policy rule and in the client’s sec mount option. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-netapp-files/kerberos)\n\n## Applicability\n\nThis guide is for a team reviewing an NFS mount to Azure NetApp Files where the required protection must be stated more precisely than simply saying Kerberos is enabled.\n\n## DSE recommendation\n\nDSE recommends having the data owner define the required authentication, integrity, and traffic-protection outcome before the mount is approved. Record the selected mode beside the export-policy rule and client mount configuration. Ask the application owner to include representative workload behavior in the test plan, especially when selecting the mode with the additional encryption work. Keep protocol and mode choices explicit in the handoff to the Linux and storage teams.\n\n## Verification\n\nInspect the active client mount and corresponding export policy, then compare both with the agreed mode. Perform the authorized file-access test and record the workload observations. Investigate a mismatch or performance concern before changing the policy, and preserve the chosen protection requirement as the acceptance criterion throughout the review.\n\n## Official references\n\n- [Microsoft: Understand Kerberos in Azure NetApp Files | Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-netapp-files/kerberos)"
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-084-specify-the-nfs-kerberos-protection-mode-in-an-azure-netapp-files-mount-review/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-084-specify-the-nfs-kerberos-protection-mode-in-an-azure-netapp-files-mount-review/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-17"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-084-specify-the-nfs-kerberos-protection-mode-in-an-azure-netapp-files-mount-review/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Specify the NFS Kerberos protection mode in an Azure NetApp Files mount review",
                        "item": "https://update.dsesecurity.com/updates/dse-20260917-084-specify-the-nfs-kerberos-protection-mode-in-an-azure-netapp-files-mount-review/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-084-specify-the-nfs-kerberos-protection-mode-in-an-azure-netapp-files-mount-review/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260917-084-specify-the-nfs-kerberos-protection-mode-in-an-azure-netapp-files-mount-review/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-084-specify-the-nfs-kerberos-protection-mode-in-an-azure-netapp-files-mount-review/",
                "headline": "Specify the NFS Kerberos protection mode in an Azure NetApp Files mount review",
                "description": "DSE recommends having the data owner define the required authentication, integrity, and traffic-protection outcome before the mount is approved.",
                "abstract": "DSE recommends having the data owner define the required authentication, integrity, and traffic-protection outcome before the mount is approved.",
                "articleBody": "Source facts\nMicrosoft distinguishes Kerberos authentication with krb5, integrity checking with krb5i, and encryption of the complete NFS conversation with krb5p. For NFS, the security mode is specified in the volume export-policy rule and in the client’s sec mount option. Microsoft Learn\nApplicability\nThis guide is for a team reviewing an NFS mount to Azure NetApp Files where the required protection must be stated more precisely than simply saying Kerberos is enabled.\nDSE recommendation\nDSE recommends having the data owner define the required authentication, integrity, and traffic-protection outcome before the mount is approved. Record the selected mode beside the export-policy rule and client mount configuration. Ask the application owner to include representative workload behavior in the test plan, especially when selecting the mode with the additional encryption work. Keep protocol and mode choices explicit in the handoff to the Linux and storage teams.\nVerification\nInspect the active client mount and corresponding export policy, then compare both with the agreed mode. Perform the authorized file-access test and record the workload observations. Investigate a mismatch or performance concern before changing the policy, and preserve the chosen protection requirement as the acceptance criterion throughout the review.\nOfficial references\n\nMicrosoft: Understand Kerberos in Azure NetApp Files | Microsoft Learn",
                "datePublished": "2026-09-17T16:33:36+00:00",
                "dateModified": "2026-09-17T16:38:45+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-084-specify-the-nfs-kerberos-protection-mode-in-an-azure-netapp-files-mount-review/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-084-specify-the-nfs-kerberos-protection-mode-in-an-azure-netapp-files-mount-review/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Specify the NFS Kerberos protection mode in an Azure NetApp Files mount review"
                },
                "articleSection": [
                    "IT"
                ],
                "keywords": [
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 207,
                "timeRequired": "PT1M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Understand Kerberos in Azure NetApp Files | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/azure/azure-netapp-files/kerberos"
                }
            }
        ]
    }
}