When NFSv4 is configured to use kerberos authentication is mandatory to have a keytab installed on every client with is own principal. To access files a user still needs to be authenticated with his principal.
What happens if a client keytab gets stolen? (or an attacker gets root privileges on a authorized client). Can the attacker use a modified version of NFS in order to bypass user authentication?
So I want to understand if user access control is performed by the client or by the server.
Bonus question: if the authorizing is done by the server, why does every client need a keytab?