Bug 78723 - Protecting portmap With iptables
Summary: Protecting portmap With iptables
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Red Hat Linux
Classification: Retired
Component: rhl-sg
Version: 8.0
Hardware: noarch
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Johnray Fuller
QA Contact: Tammy Fox
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2002-11-28 11:15 UTC by juha.heljoranta
Modified: 2007-04-18 16:48 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2003-02-14 00:19:12 UTC
Embargoed:


Attachments (Terms of Use)

Description juha.heljoranta 2002-11-28 11:15:20 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2) Gecko/20021127

Description of problem:
Chapter 5. Server Security
Securing Portmap

Could You add note that when protecting portmap with iptables it might be
important to allow connections to localhost:sunrpc.

Why? Because by dropping packets on 127.0.0.1:111 prevents fam to work
correctly.  Fam might not be the only component that depends from sunrpc.

Comment 1 Johnray Fuller 2002-12-09 14:11:52 UTC
I will look iinto this and update the server chapter for the next revision.

Thank you so much for catching this.

Take care,
Johnray

Comment 2 Johnray Fuller 2003-02-14 00:19:12 UTC
Below are two example iptables commands that
allow TCP connections to the portmap service (listening on
port 111) from the 192.168.0/24 network and from the localhost (which
is necessary for the sgi_fam service used by
Nautilus). All other packets are dropped.


iptables -A INPUT -p tcp -s 127.0.0.1  --dport 111 -j ACCEPT

Thanks for catching that.

Johnray


Note You need to log in before you can comment on or make changes to this bug.