From owner-freebsd-current@FreeBSD.ORG Thu Oct 7 01:30:04 2004 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 4ED0D16A4D4 for ; Thu, 7 Oct 2004 01:30:04 +0000 (GMT) Received: from dan.emsphone.com (dan.emsphone.com [199.67.51.101]) by mx1.FreeBSD.org (Postfix) with ESMTP id 06E6F43D54 for ; Thu, 7 Oct 2004 01:30:04 +0000 (GMT) (envelope-from dan@dan.emsphone.com) Received: (from dan@localhost) by dan.emsphone.com (8.12.11/8.12.11) id i971U1mP023834; Wed, 6 Oct 2004 20:30:01 -0500 (CDT) (envelope-from dan) Date: Wed, 6 Oct 2004 20:30:01 -0500 From: Dan Nelson To: Sean McNeil Message-ID: <20041007013001.GH3848@dan.emsphone.com> References: <1097095438.1208.7.camel@server> <20041006205954.GB3848@dan.emsphone.com> <1097102594.1805.4.camel@server> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1097102594.1805.4.camel@server> X-OS: FreeBSD 5.3-BETA7 X-message-flag: Outlook Error User-Agent: Mutt/1.5.6i cc: freebsd-current@freebsd.org Subject: Re: amd sitting on ldaps port X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Oct 2004 01:30:04 -0000 In the last episode (Oct 06), Sean McNeil said: > On Wed, 2004-10-06 at 13:59, Dan Nelson wrote: > > In the last episode (Oct 06), Sean McNeil said: > > > Looking at /etc/services is states that 636 is for ldaps, but I see that > > > amd is using it: > > > > > > server# sockstat | grep 636 > > > root amd 468 5 tcp4 *:636 *:* > > > > That's just a random port rpcbind assigned to the "amd" rpc service. > > If you reboot I bet it'll bind to a different port. Run "rpcinfo -p > > localhost" to see all the local port numbers assigned to RPC clients. > > OK, but aren't there rules about rpc allowing assigned ports like that? Not as far as I know. I suppose bindresvport() could be changed to walk /etc/services and only use one of the 450 reserved ports not listed. Another alternative is to set the net.inet.ip.portrange.lowlast sysctl a little higher; 700 maybe. 600-1024 is the portrange that has been historically assigned as "local port numbers that root processes can use". -- Dan Nelson dnelson@allantgroup.com