shared home directory placement

[Jason <jason () jasonandjessi com>]

hello all, I have a best practices question. I have a large pool of unix
folks that have shared storage for home directories (NFS). Right now,
they only have access to these directories from systems that are located
in the TRUST zone of our network, but we are redesigning things to
segment systems further which will put some systems into a less trusted
zone.  When it's all said and done, hosts that will be in a dmz and
hosts that will be in trust will still need access to this NFS server.
What I was wondering is if it would be a Terrible Idea  to move the NFS
server into a DMZ of it's own, out of the Trust zone, and allow access
to it from the hosts in different DMZs as well as hosts in the trust
zone. If the NFS server is compromised by an upstream system, policy
won't allow that system to initiate connections outside of it's own DMZ.

I guess the short question is have any of you setup shared storage that
is accessible from trusted and non trusted zones?


--
Jason
Luck favors the prepared