The portmap service is a dynamic port
assignment daemon for RPC services such as NIS and NFS. It has weak
authentication mechanisms and has the ability to assign a wide
range of ports for the services it controls. For these reasons, it
is difficult to secure.
 |
Note |
| |
Securing portmap only affects NFSv2 and
NFSv3 implementations, since NFSv4 no longer requires it. If you
plan to implement a NFSv2 or NFSv3 server, then portmap is required, and the following section
applies.
|
If running RPC services, follow these basic rules.
It is important to use TCP wrappers to limit which networks or
hosts have access to the portmap service
since it has no built-in form of authentication.
Further, use only IP addresses when
limiting access to the service. Avoid using hostnames, as they can
be forged via DNS poisoning and other methods.
To further restrict access to the portmap service, it is a good idea to add IPTables
rules to the server and restrict access to specific networks.
Below are two example IPTables commands that allow TCP
connections to the portmap service
(listening on port 111) from the 192.168.0/24 network and from the
localhost (which is necessary for the sgi_fam service used by Nautilus). All other packets are dropped.
iptables -A INPUT -p tcp -s! 192.168.0.0/24 --dport 111 -j DROP
iptables -A INPUT -p tcp -s 127.0.0.1 --dport 111 -j ACCEPT
|
To similarly limit UDP traffic, use the following command.
iptables -A INPUT -p udp -s! 192.168.0.0/24 --dport 111 -j DROP
|
 |
Tip |
| |
Refer to Chapter 7 Firewalls for
more information about implementing firewalls with IPTables
commands.
|
