Kerberos is a network authentication protocol that allows secure authentication for clients and servers over a non-secure network. It uses symmetric key cryptography and requires a trusted Key Distribution Center (KDC) to authenticate users and services.

Unlike AUTH_SYS, RPCSEC_GSS Kerberos mechanism ensures the server does not depend on the client to correctly represent which user accesses the file. Instead, the system uses cryptography to authenticate users to the server. This prevents a malicious client from impersonating a user without having the Kerberos credentials of that user.

In the /etc/exports file, the sec option defines one or multiple methods of Kerberos security that the share should provide. Clients can mount the share with one of these methods where The sec option supports the following values:

• sys: no cryptographic protection (default)
• krb5: authentication only
• krb5i: authentication and integrity protection
• krb5p: authentication, integrity checking, and traffic encryption

Note that the more cryptographic functionality a method provides, the lower is the performance.