topic Re: Change port for rpc.mountd in Operating System - HP-UX

Change port for rpc.mountd

Tom Fellowes — Tue, 22 Feb 2005 15:20:48 GMT

Our systems get scanned by another group that uses ISS. We got the vulnerability:

MountdReserved: NFS mount daemon operating on an non-reserved port
(Yes the bad grammar was in there)

Is there a way to change the port that rpc.mountd runs on so it's a privileged port? I don't see anything in the man pages and have never tried this before. I saw an earlier post from someone using TruUnix, but he said he used the "-p" option and it worked out. My man page for mountd shows that "-p" is obsolete (and when I tried it, rpc.mountd ran on about the same port).

We're running HPUX 11.11. Fairly well patched-up.

Re: Change port for rpc.mountd

Steven E. Protter — Tue, 22 Feb 2005 15:24:18 GMT

Check your /etc/services file.

NFS is inherently insecure and there is nothing you can do about it if you need to use NFS, which most HP-UX systems need at least the client portion.

SEP

Re: Change port for rpc.mountd

harry d brown jr — Tue, 22 Feb 2005 15:37:41 GMT

if you don't need NFS, then shut it down!

"-p" is obsolete

For HP-UX 11.00, 11.11, and 11.22:
Apply the appropriate patch for your system, as listed in Hewlett-Packard Company Security Bulletin HPSBUX0308-272. See References.
(http://xforce.iss.net/xforce/xfdb/347)

live free or die
harry

Re: Change port for rpc.mountd

Jeff Schussele — Tue, 22 Feb 2005 15:41:33 GMT

Hi Tom,

Well the standard NFS port is 2049/udp or 2049/tcp & the status port 1110/udp with the keepalive 1110/tcp.
These are the *standard* ports.

If they are expecting you to run it on a port < 1024 then NFS could *only* be used by root because *normal* users cannot access ports below that.
Would kind of make automount & autofs useless for those users.

Rgds,
Jeff

Re: Change port for rpc.mountd

Andrew Cowan — Wed, 23 Feb 2005 02:39:41 GMT

The only ways to run a "secure" nfs is to either tunnel it through IP-SEC, or to install NFS version 4, and setup Kerberos authentication etc.

You're biggest security hole when running NFS is not actually NFS itself, it's the "portmapper" service that it uses to advertise the available ports.