The Portmapper

Posted by admin

May 7, 2008

The portmapper keeps a list of what services are running on what ports. This list is used by a connecting machine to see what ports it wants to talk to access certain services.

The portmapper is not in as bad a shape as a few years ago but it is still a point of worry for many sys admins. The portmapper, like NFS and NIS, should not really have connections made to it outside of a trusted local area network. If you have to expose them to the outside world - be careful and keep up diligent monitoring of those systems.

Not all Linux distributions were created equal. Some seemingly up-to-date distributions do not include a securable portmapper. The easy way to check if your portmapper is good or not is to run strings(1) and see if it reads the relevant files, /etc/hosts.deny and /etc/hosts.allow. Assuming your portmapper is /sbin/portmap you can check it with the following command. A securable machine will produce output like this:

# strings /sbin/portmap | grep hosts.
/etc/hosts.allow
/etc/hosts.deny
@(#) hosts_ctl.c 1.4 94/12/28 17:42:27
@(#) hosts_access.c 1.21 97/02/12 02:13:22
#

First, let’s edit /etc/hosts.deny. Add the following line to the file:

portmap: ALL

which will deny access to everyone. While it is closed run:

rpcinfo -p

just to check that your portmapper really reads and obeys this file. Rpcinfo should give no output, or possibly an error message. The files /etc/hosts.allow and /etc/hosts.deny take effect immediately after you save them. No daemon needs to be restarted.

Closing the portmapper for everyone is a bit drastic, so we open it again by editing /etc/hosts.allow. But first we need to figure out what to put in it. It should basically list all machines that should have access to your portmapper. On a run of the mill Linux system there are very few machines that need any access for any reason. The portmapper administers nfsd, mountd, ypbind/ypserv, rquotad, lockd (which shows up as nlockmgr), statd (which shows up as status) and ‘r’ services like ruptime and rusers. Of these only nfsd, mountd, ypbind/ypserv and perhaps rquotad,lockd and statd are of any consequence. All machines that need to access services on your machine should be allowed to do that. Let’s say that your machine’s address is 192.168.0.254 and that it lives on the subnet 192.168.0.0, and that all machines on the subnet should have access to it . Then we write:

portmap: 192.168.0.0/255.255.255.0

in /etc/hosts.allow. If you are not sure what your network or netmask are, you can use the ifconfig command to determine the netmask and the netstat command to determine the network. For, example, for the device eth0 on the above machine ifconfig should show:

...
eth0   Link encap:Ethernet  HWaddr 00:60:8C:96:D5:56
	     inet addr:192.168.0.254  Bcast:192.168.0.255 Mask:255.255.255.0
	     UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
	     RX packets:360315 errors:0 dropped:0 overruns:0
	     TX packets:179274 errors:0 dropped:0 overruns:0
	     Interrupt:10 Base address:0x320
...

and netstat -rn should show:

Kernel routing table
Destination     Gateway         Genmask         Flags Metric Ref Use    Iface
...
192.168.0.0     0.0.0.0         255.255.255.0   U     0      0   174412 eth0
...

(The network address is in the first column).

The /etc/hosts.deny and /etc/hosts.allow files are described in the manual pages of the same names.

IMPORTANT: Do not put anything but IP NUMBERS in the portmap lines of these files. Host name lookups can indirectly cause portmap activity which will trigger host name lookups which can indirectly cause portmap activity which will trigger…

Versions 0.2.0 and higher of the nfs-utils package also use the hosts.allow and hosts.deny files, so you should put in entries for lockd, statd, mountd, and rquotad in these files too.

The above things should make your server tighter. The only remaining problem is if someone gains administrative access to one of your trusted client machines and is able to send bogus NFS requests. The next section deals with safeguards against this problem.

Share and Enjoy: These icons link to social bookmarking sites where readers can share and discover new web pages.