RE: NFS Over Private Network

Hi Erek,

I can understand the comment about old code but I've never had issues
with the version of rpcbind on production systems.  Normally I do not
allow NFS due to the many security issues associated with it. Sometimes
though, it has to be allowed, short of putting in a firewall between the
systems, there is little the native OS provides that covers portmap
access.

As a side feature, the ability to save portmap settings across across
sessions is very useful, it saves the need to reconfigure the firewall
rules whenever portmap is restarted.

I consider it more valuable that access to the portmapper is recorded
and/or restricted than relying on the RPC apps to protect themselves.
Many canned RPC exploits do not work if they cannot access the
portmapper to find the application. 

As with all changes, you have to test it in your environment and assess
the risks associated with replacing the native utility with another.
What is acceptable in one place may not be in another. 

As they say, YMMV :-)


Rgds,

Simon
-----Original Message-----
From: Erek Adams [mailto:[email protected]]
Sent: Saturday, March 27, 2004 01:36
To: Simon Thornton
Cc: 'Michael Wright'; [email protected]
Subject: RE: NFS Over Private Network


On Thu, 25 Mar 2004, Simon Thornton wrote:

> At the least I would replace the SUN portmapper with the one from the
> TCPwrappers suite. This will allow you to restrict access
> (/etc/hosts.allow) on the IP level to portmap and therefore to some
> services.

[...snip...]

Actually, that's not really a good idea.  Take a look at this message
from
Alex Noordergraaf on that subject.

--Msg--

Date: Thu, 06 Nov 2003 20:01:44 -0500
From: Alex Noordergraaf <[email protected]>
To: Jonathan Loran <[email protected]>
Cc: [email protected]
Subject: Re: Disabling rpcbind/portmapper

Jonathan Loran wrote:
>
> How about the libwrap version of rpcbind by Wietse Venema?  Simple
> /etc/hosts.{allow,deny} control.

Wietse's version of rcpbind is based on early Solaris code (~2.5) and
isn't generally recommended for production use anymore.

-Alex

--End--

Cheers!

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net