mailing list archives
(Q) Sun Rpcbind problem.
From: Chiaki.Ishikawa () PERSONAL-MEDIA CO JP (Chiaki Ishikawa)
Date: Fri, 10 Apr 1998 20:31:14 +0900
Lately, there is an annoucement from Sun regarding security problem
with its rpcbind.
At the office, one of the solaris machine uses a rpcbind replacement:
part of the README is attached at the end.
Does anyone have an idea if I should upgrade to the Sun rpcbind, or
the replacement rpcbind is OK?
=== begin quote ====
README for rpcbind 1.1 on Fri Dec 9 17:34:12 MET 1994
This is an rpcbind replacement with tcp wrapper style access control.
It provides a simple mechanism to discourage remote access to the NIS
(YP), NFS, and other rpc services.
Alas, the Solaris 2.4 rpcbind will still export file systems to the
world through proxy rpc.
This version is based on the freely-distributable tirpcsrc2.3 source
distribution, as offered for anonymous FTP from playground.sun.com.
According to the README:
TIRPCSRC 2.3 29 Aug 1994
This distribution contains SunSoft's implementation of
transport-independent RPC (TI-RPC), External Data Representation
(XDR), and various utilities and documentation. These libraries
and programs form the base of Open Network Computing (ONC), and are
derived directly from the Solaris 2.3 source.
The program has undergone limited testing with SunOS 5.3 (Solaris 2.3).
It is obviously very compatible with Solaris 2.3. It will probably work
as well with earlier Solaris 2.x versions.
- host access control on IP addresses. The local host is considered
authorized. Host access control requires the libwrap.a library that
comes with recent tcp wrapper implementations.
- requests that are forwarded by the rpcbind process will be forwarded
through an unprivileged port.
- the rpcbind process refuses to forward requests to rpc daemons that
do (or should) verify the origin of the request: at present, the list
includes most of the calls to the NFS mountd/nfsd daemons and the NIS
Thanks to Robert Montjoy for helping with the port of my tirpcsrc1.0
patches to the tirpcsrc2.0 environment.
Wietse Venema (wietse () wzv win tue nl)
Mathematics and Computing
Science Eindhoven University of Technology
=== end quote ====
Ishikawa, Chiaki ishikawa () personal-media co jp NoSpam or
(family name, given name) Chiaki.Ishikawa () personal-media co jp NoSpam
Personal Media Corp. ** Remove .NoSpam at the end before use **
Shinagawa, Tokyo, Japan 142