Can sunrpc be configured to listen only to localhost?

Robhogg · 03-01-2006, 09:21 AM

I've been reading about the vulnerabilities arising from the sunrpc server. Running netstat -A inet --listening shows the following services:

Code:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 localhost:10024         *:*                     LISTEN
tcp        0      0 localhost:10025         *:*                     LISTEN
tcp        0      0 *:mysql                 *:*                     LISTEN
tcp        0      0 *:sunrpc                *:*                     LISTEN
tcp        0      0 *:ipp                   *:*                     LISTEN
tcp        0      0 localhost:smtp          *:*                     LISTEN
udp        0      0 *:filenet-tms           *:*
udp        0      0 *:bootpc                *:*
udp        0      0 *:mdns                  *:*
udp        0      0 *:sunrpc                *:*
udp        0      0 *:ipp                   *:*

I guess that the "*:*" under "Foreign Address" means that it is listening for connection requests from any other address. When I scan port 111 using Shields Up!, it is shown to be stealthed (due to the firewall). However, I would feel more comfortable if it was listening only to localhost.

Is it possible to configure it to do this? Do I need it to be running at all?

Also, any comments on *:filenet-tms? This is listening on port 32768. Under "Trojan Sightings", Shields Up! shows Hacker's Paradise

Thanks,
Rob

Capt_Caveman · 03-01-2006, 10:50 AM

Do you actually need sunrpc running?

Do you need all of those services running?

This is listening on port 32768. Under "Trojan Sightings", Shields Up! shows Hacker's Paradise
Port 32768 is part of the dynamic port range, so any unprivileged service can open a socket on it. It also happens to be a very common first port allocated when any unprivileged service establishes a port in linux.

To find out what service that is, try running 'lsof -i :32768' or alternatively 'netstat -pantu | grep 32768' and then lookup the PID number in /proc/<PID>/cmdline. My guess would be that it belongs to the rpc service. I highly doubt that it's Hackers Paradise and most of those scanners simply match open ports to a list of common service/trojan ports rather than doing any kind of port interrogation like nmap.

narmida · 03-01-2006, 05:27 PM

a not very nice sollution could be to block the port with iptables except lo

primo · 03-02-2006, 07:37 PM

Run "rpcinfo -p localhost" to see currently available RPC services. The portmapper always binds to 0.0.0.0:111 but you can add the line "portmap: ALL" to /etc/hosts.deny or "portmap: DENY: ALL" to /etc/hosts.allow. See "man 5 hosts.allow".