Very Computer

-----BEGIN PGP SIGNED MESSAGE-----

Quote:> Hello,

> also, i am curious if there is any way to disable any hosts
> except localhost fropm ever accessing these services.

you want to get the latest version of tcp wrappers and become
intimately familiar with them.

you can get these here: ftp://ftp.cert.org

if you need assistance with configuration i can give you a hand.

- -pjf

- --
"Those that give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety." -- Benjamin Franklin (1773)

zifi runs LINUX 2.0.30  -=-=-=WEB=-=-=->  http://zifi.genetics.utah.edu

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface

iQCVAwUBM39VLE3Qo/lG0AH5AQHWzgQAk7KKSrARN51w9bcyqYe27j8aIUpOSNoP
Fp+35Xug/jEwnNDEldIJ2IWWZavV0DnohTWslFckB8P6G+c+LdzWmxD9ktbAmKc1
RMuyXjhSwMdzEq/6WoW7wkarU/cjIBGZSsxFDn/ofjBGB/apQpDxpE0DqCyJyt+w
7WbwjSToFtU=
=HoKc
-----END PGP SIGNATURE-----

[Securing RPC services]

Quote:>> also, i am curious if there is any way to disable any hosts
>> except localhost fropm ever accessing these services.

> you want to get the latest version of tcp wrappers and become
> intimately familiar with them.
> you can get these here: ftp://ftp.cert.org
> if you need assistance with configuration i can give you a hand.

Specifically, you want Wietse's secure portmapper/rpcbind.  Although
I don't believe this protects you from every kind of attack wrt RPC,
but it's certainly worth installing.

-Paul-

Quote:>I am curious if there are any security risks associated with running
>rc.local:        Run /usr/sbin/rpc.portmap
>rc.local:        Run /usr/sbin/rpc.mountd
>rc.local:        Run /usr/sbin/rpc.nfsd

If you are not running NFS to mount (or export) filesystems between
machines, turn these off. If you are, obtain Wietse Venema's wrapped
portmapper (ftp.win.tue.nl:/pub/security) and disallow access to the
portmapper from as many services as possible. If you're able, filter out
accesses to TCP/UDP at 111 and 2049 (portmap and NFS, respectively).

--
----------------

----------------
exit(main(kfp->kargc, argv, environ));