Date: Fri, 11 Oct 2002 18:49:58 -0400 (EDT) From: Dru <dlavigne6@cogeco.ca> To: Mark <mw@lanfear.com> Cc: "DaleCo, S.P.---'the solutions people'" <daleco@daleco.biz>, <questions@FreeBSD.ORG> Subject: Re: NFS rules for ipfw Message-ID: <20021011182231.I1552-100000@dhcp-17-14.kico2.on.cogeco.ca> In-Reply-To: <20021011205606.DD65443E88@mx1.FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, 11 Oct 2002, Mark wrote: > > It's been remarkably non trivial to find out what ports NFS is using. A > search through a few NFS and TCP programming books here have yielded little, > as has google. > > However, I did do a tcpdump on the failed connect, and there was activity on > the sunrpc port, and then 713, 714, and 1023 (all UDP). > > I'll fiddle with more ipfw rules and see what i can't come up with. My > relative beginner's status with firewalls becomes apparent rapidly .... Hi Mark, You didn't say what information you found, but I assume you discovered that portmapper uses port 111 and NFS uses port 2049. Are you _absolutely_, positively sure that you _really_ really, really want to do this? That there is absolutely no other way to share that data between network segments? What you're asking is the sort of question that stops a security admin dead in his tracks as he turns pale, his eyes go buggy, he gasps for breath, and clutches his heart in terror... Let's see here. You need to: - open up RPC (see www.sans.org/top20 if you don't know why RPC is a bad thing yet). This requires port 111 to receive the port-mapping request. Then ports 1024 to 65535 (both TCP and UDP!) need to be left open so portmapper can do its thing. Might as well throw your firewall away. - use "mountd", "lockd", and "statd" which are all RPC based. They are interesting terms to look up at search.cert.org Now, having said all that, you can reduce your risk by making sure the FreeBSD box is fully up-to-date and patched, use stateful rules and be picky on source and destination. However, this is only decreasing the risk of a very huge security risk. Both NFS and RPC were designed to stay on one LAN segment; they're an accident waiting to happen when you start punching holes in order to share information across LAN segments. You really should have a very compelling reason before you consider taking that risk. HTH, Dru To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20021011182231.I1552-100000>