up vote 1 down vote favorite
share [g+] share [fb]

I have an Ubuntu 9.10 server with a public and private interface. I'd like to run portmap only on the private interface for security, so in /etc/default/portmap I had set:

OPTIONS="-i 192.168.122.1"

But this made nfs-kernel-server fail to start, since it's trying to talk to portmap on 127.0.0.1, which, though local, is not 192.168.122.1! (The obvious solution of adding -i 127.0.0.1 doesn't work; it only takes the last -i option.) So instead I took out that line and instead set /etc/hosts.allow to:

portmap mountd nfsd statd lockd rquotad : 192.168.122.0/255.255.255.0

and /etc/hosts.deny to:

portmap mountd nfsd statd lockd rquotad : ALL

as documented in https://help.ubuntu.com/community/SettingUpNFSHowTo -- and restarted portmap. But I can still nc into the server on port 111 from a remote machine. It doesn't seem to let me do anything useful, but could I convince it to not even listen on the public interface to begin with?

link|improve this question
Hm, it seems that hosts.allow only blocks requests after the initial connection. (Because I'd messed it up by forgetting the trailing period in 192.166.122.) I would have thought it should deny at connection time, to give the lowest possible attack surface. Of course I should have a firewall and enforce all these rules several times, but it would still be better if it just didn't even listen on the interface to begin with. – Ken Arnold Jan 29 '10 at 5:23
This link points to some patches for portmap that do what you want: unixresources.net/linux/lf/58/archive/00/00/10/48/104883.html It's from 2004 and Fedora so you'll probably have some fiddling with it. Looks like something nearly went into ubuntu a while back: bugs.launchpad.net/bugs/7265 – davey Jan 29 '10 at 8:05
@davey: You should post this comment as an answer. Ken, did this help? – MikeyB Dec 9 '11 at 3:38
feedback

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
or
required, but never shown
discard

Browse other questions tagged or ask your own question.