Date: Tue, 25 Jan 2005 21:09:45 -0800 From: Sandy Rutherford <sandy@krvarr.bc.ca> To: cpghost <cpghost@cordula.ws> Cc: freebsd-questions@freebsd.org Subject: Re: Restricting NFS daemons Message-ID: <16887.9753.14706.630611@szamoca.krvarr.bc.ca> In-Reply-To: <41F75C88.209@cordula.ws> References: <41F640BA.2040707@cordula.ws> <16886.56708.519994.924956@szamoca.krvarr.bc.ca> <41F75C88.209@cordula.ws>
next in thread | previous in thread | raw e-mail | index | archive | help
>>>>> On Wed, 26 Jan 2005 10:02:00 +0100,
>>>>> cpghost <cpghost@cordula.ws> said:
> But the question is how to get rpcbind to use tcp-wrappers
> in the first place!
> Because even with this in hosts.allow, sockstat -46l still
> shows:
> root rpcbind 10188 7 udp4 127.0.0.1:111 *:*
> root rpcbind 10188 8 udp4 192.168.1.1:111 *:*
> root rpcbind 10188 9 udp4 *:<some_random_port> *:*
> root rpcbind 10188 10 tcp4 *:<some_random_port> *:*
> So it's still binding to INADDR_ANY :-(
> Am I missing something obvious, or is rpcbind not "tcp wrapped"
> by default?
Should be. Double check to make sure that /usr/sbin/portmap is linked
to libwrap.
On 4.10, I have:
% objdump -x portmap | head -n 25
/usr/libexec/elf/objdump: portmap: no symbols
portmap: file format elf32-i386
portmap
architecture: i386, flags 0x00000112:
EXEC_P, HAS_SYMS, D_PAGED
start address 0x08048de8
Program Header:
PHDR off 0x00000034 vaddr 0x08048034 paddr 0x08048034 align 2**2
filesz 0x000000c0 memsz 0x000000c0 flags r-x
INTERP off 0x000000f4 vaddr 0x080480f4 paddr 0x080480f4 align 2**0
filesz 0x00000019 memsz 0x00000019 flags r--
LOAD off 0x00000000 vaddr 0x08048000 paddr 0x08048000 align 2**12
filesz 0x00002700 memsz 0x00002700 flags r-x
LOAD off 0x00002700 vaddr 0x0804b700 paddr 0x0804b700 align 2**12
filesz 0x000001ec memsz 0x00000218 flags rw-
DYNAMIC off 0x0000275c vaddr 0x0804b75c paddr 0x0804b75c align 2**2
filesz 0x000000b8 memsz 0x000000b8 flags rw-
NOTE off 0x00000110 vaddr 0x08048110 paddr 0x08048110 align 2**2
filesz 0x00000018 memsz 0x00000018 flags r--
Dynamic Section:
NEEDED libwrap.so.3
NEEDED libc.so.4
INIT 0x8048adc
I am not surprised that rpcbind is still bound to all of your
interfaces. AFAIK, tcp-wrappers doesn't control which interface is
being listened on, but rather it controls from which IP numbers
connections will be accepted. This is what I meant, when I said that
tcp-wrappers doesn't do exactly what you want. However, if you use
tcp-wrappers to accept only connections from 192.168.1.0/255.255.255.0
and configure a firewall on this host to block all connections to the
interface in question from this address range, then you will end up
with something approximating what you want.
...Sandy
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?16887.9753.14706.630611>