Close service portmap

[Marcelo De Florio]

I have close portmap service, this service work together with nfs ?

bye
MDF

[Antoanetta Naghiu]

Yes. NFS is using RPC. If you are using HP 11.0 do not need portmap, instead you'll need rpcbind.

[Marcelo De Florio]

Then I haven't problem to close this port ?

[Alan Riggs]

If portman was open and nfs was relying upon it, then you will have a problem.

Are you running 11.00? If so, you should have rpcbind running.

Run rpcinfo -p `hostname`. That should tell you what services are registered with rpc.

[Antoanetta Naghiu]

If you are using NFS, when you connect, the request goes on post 111 that is portmap. So, if your machine is NFS Server you need portmap service port 111 enable. From the client side, let me think: the socket is ip.unreserved_port... You still need to have rpcbind and biod running in the client...
But rpcbind is started before inetd...
In server side, you need for sure portmap service, in client side, I guess you could be ok... But, why you like to close portmap service?

[Marcelo De Florio]

I have a close the portmap for security issue. And then anything service of rpc used the portmap service ?

[Antoanetta Naghiu]

The NFS Server is using portmap service (port 111) for getting requests. So, if your machine exports NFS file systems, you need to let portmap sevice open. In both, HP-UX 10.20 or HP11.
If the machine is just a client, and portmap from /etc/services is comment out, NFS is ok.
So, you can work with NFS from client side having portmap service taken out.

[Marcelo De Florio]

Antoanetta, ok, but my question is another service used the portmap ?
for example: ito rpc.

[Alan Riggs]

Many other services use portmapper: nis, rpc, mountd, keyserv, etc.

To determine what services are registered with portmapper on the server in question do:

rpcinfo -p `hostname`

[Antoanetta Naghiu]

I had portmap service -port 111 from /etc/services file comment out and I still mount remote file systems. rpc.bind daemon (11) or portmapd (10.20) is started before inetd daemon. /etc/services is read and controll by inetd daemon.
So, I am not sure if other services access port 111, I think, no. Should not interact with anything else. Is just a port. Depends on that else you disable.
But, if you want secured environment there are other things that you need to do. I have a box that has none of the Berkely services, no telnet (I use ssh), and lots the others...

[Marcelo De Florio]

Alan, If I can close the portmap but and then any service (eg nis, rpc) worked properly.

[Marcelo De Florio]

Alan, If I can close the portmap but and then any service (eg nis, rpc) worked properly.

[Alan Riggs]

I think you are saying that you kileld the portmapper but your nis, nfs, etc. still ran. If so, please try the rpcinfo command again after portmapper has been killed (just to check to see whether it has restarted).

Assuming that portmapper is still down, I would say that the subsystems are managing to function only because their port number references are stored in some type of cached resource. As a rule, all PRC requests must go through portmapper to sync the DARPA port numbers with RPC program numbers. (subsystems register with portmapper, telling it what ports they listen to and what RPC requests they are prepared to serve.)