how do I secure the ypbind daemon

[Mick Goddard_1]

A Intrusion report lists that ypbind is running over a non-reserved port. And it needs to be moved to a reserved ports to pass Intrusion tests.

It is a HP700 10.20. I have tried setting YPBIND_OPTIONS = "-s" in /etc/rc.config.d/namesvrs file on NIS Master
and Client. Both machines report error message
on startup of NIS

"Secure mode sunos 3.x servers rejected"

Can anyone help me configue this properly.

Regards

Mick

[harry d brown jr]

Mick,

From the man pages of ypbind:

The "-s" option:

"-s" Secure. When specified, only NIS servers bound to a reserved port are used. This allows for a slight increase in security in completely controlled environments, where there are no computers operated by untrusted individuals. It offers no real increase in security.


Get the security patch checker and see if there are any patches that may apply:

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=B6834AA

live free or die
harry

[K.Vijayaragavan.]

Hi,

check the file "/var/yp/secureservers"

See also,
man ypserv

-Vijay

[Mick Goddard_1]

putting a couple of NIS servers in the file
/var/yp/secureservers has stopped the
sunos 3x error message . But it now fails
NIS client with the message
FAILURE code 1 after the ypbind daemon tries to start up in file /sbin/rc.d/S420nis.client

I have tried adding NIS clients to the
/var/yp/securenets file but I get NIS master FAILURE codes as well.

Hope this makes sense and help me further.

Is the format of the secureservers file

Subnet_mask IP_ADDRESS e.g.
255.255.252.0 137.229.234.20
255.255.252.0 137.229.237.21

Mick