Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an Ubuntu 9.10 server with a public and private interface. I'd like to run portmap only on the private interface for security, so in /etc/default/portmap I had set:


But this made nfs-kernel-server fail to start, since it's trying to talk to portmap on, which, though local, is not! (The obvious solution of adding -i doesn't work; it only takes the last -i option.) So instead I took out that line and instead set /etc/hosts.allow to:

portmap mountd nfsd statd lockd rquotad :

and /etc/hosts.deny to:

portmap mountd nfsd statd lockd rquotad : ALL

as documented in -- and restarted portmap. But I can still nc into the server on port 111 from a remote machine. It doesn't seem to let me do anything useful, but could I convince it to not even listen on the public interface to begin with?

share|improve this question
Hm, it seems that hosts.allow only blocks requests after the initial connection. (Because I'd messed it up by forgetting the trailing period in 192.166.122.) I would have thought it should deny at connection time, to give the lowest possible attack surface. Of course I should have a firewall and enforce all these rules several times, but it would still be better if it just didn't even listen on the interface to begin with. – Ken Arnold Jan 29 '10 at 5:23
This link points to some patches for portmap that do what you want: It's from 2004 and Fedora so you'll probably have some fiddling with it. Looks like something nearly went into ubuntu a while back: – davey Jan 29 '10 at 8:05
@davey: You should post this comment as an answer. Ken, did this help? – MikeyB Dec 9 '11 at 3:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.