README for rpcbind 2 on Tue Jul 29 16:58:58 EDT 1997 Description ----------- This is an rpcbind replacement with tcp wrapper style access control. It provides a simple mechanism to discourage remote access to the NIS (YP), NFS, and other rpc services. This version is based on the freely-distributable tirpcsrc2.3 source distribution, as offered for anonymous FTP from playground.sun.com. According to the README: TIRPCSRC 2.3 29 Aug 1994 This distribution contains SunSoft's implementation of transport-independent RPC (TI-RPC), External Data Representation (XDR), and various utilities and documentation. These libraries and programs form the base of Open Network Computing (ONC), and are derived directly from the Solaris 2.3 source. This rpcbind release was tested by me on Solaris 2.5 for SPARC. Features -------- - host access control on IP addresses. The local host is considered authorized. Host access control requires the libwrap.a library that comes with recent tcp wrapper implementations. - requests that are forwarded by the rpcbind process will be forwarded through an unprivileged port. - the rpcbind process refuses to forward requests to rpc daemons that do (or should) verify the origin of the request: at present, the list includes most of the calls to the NFS mountd/nfsd daemons and the NIS daemons. - the rpcbind process refuses REMOTE requests sent to high-numbered UDP ports (instead of TCP or UDP ports 111). High-numbered ports are opened by the rpcbind server as a side effect of other activity. These ports could be abused to bypass packet filtering restrictions. See the advisory (and addendum) on http://www.secnet.com/ Restrictions ------------ The host access control code looks at IP addresses only. No protection against IP address spoofing attacks. Implementing this protection turns out to be harder than with my version 5 portmapper replacement, and I will not work on this until I have local access to the console of a Solaris machine. Proper router hygiene can alleviate the IP address spoofing problem. Limiting access to the rpcbind daemon does not protect you from direct attacks on the rpc daemons themselves; the main task of rpcbind is to maintain a table of available RPC services and of the network ports that they are listening on. On the other hand, even though rpcbind with access control only makes an attack more difficult, it still provides an excellent early warning system. Installation ------------ (1) Follow the instructions in the Makefile, then build the rpcbind executable. (2) Terminate (kill -TERM) the running rpcbind process. With "kill -TERM" the rpcbind daemon will save its state in files in /tmp. If you kill the rpcbind process without saving its tables you will have to reboot the machine. (3) Start the new rpcbind program with the -w (warmstart) option. This causes the program to initialize from the tables saved in step (2). In order to revert to the original rpcbind daemon, kill off the running one with "kill -TERM", and start the original one. Suggested entries for the host access-control files are: /etc/hosts.allow: rpcbind: your.sub.net.number/your.sub.net.mask rpcbind: 255.255.255.255 0.0.0.0 /etc/hosts.deny rpcbind: ALL: (/some/where/safe_finger -l @%h | /bin/mail root) & Safe_finger comes with later tcp/ip daemon wrapper releases. It gives better protection than the standard finger command. The syntax of the access-control files is described in the hosts_access.5 manual page that comes with the tcp/ip daemon wrapper (log_tcp) sources. The second line in the hosts.allow file may be needed in case there are unconfigured systems on your network segment. In order to avoid deadlocks, the rpcbind program does not attempt to look up the remote host name, nor will it try to match NIS netgroups. There is no need to specify the local system: since it runs the rpcbind daemon, it is authorized by definition. The reason for permitting whole networks in the hosts.allow file is that many systems produce broadcast rpc requests when booting. Testing: -------- Normally, only rejected requests will be reported via the syslog daemon. Logging is done in a child process, in order to avoid possible deadlock in case the logging code needs assistance from the rpcbind process. By default, the rpcbind process will be utterly silent. In fact, the rpcbind daemon is not consulted that often. Sending a SIGHUP signal to the rpcbind process will enable the logging of all requests. With verbose logging turned on, requests such as "showmount" or "rpcinfo" should show up with log file entries such as: MMM dd hh:mm:ss hostname rpcbind: connect from x.x.x.x to getport(mountd) MMM dd hh:mm:ss hostname rpcbind: connect from y.y.y.y to dump() MMM dd hh:mm:ss hostname rpcbind: connect from loopback(xxxx) to unset() In case of IP clients, the source IP address is logged; otherwise, the transport name and universal address are logged as transport(address). Send another SIGHUP to the rpcbind process to turn the verbose logging off. Acknowledgements: ----------------- Thanks to Robert Montjoy for helping with the port of my tirpcsrc1.0 patches to the tirpcsrc2.0 environment. Wietse Venema (wietse@wzv.win.tue.nl) Mathematics and Computing Science Eindhoven University of Technology The Netherlands