ipfilter and ypserv

[Steven Whatley]

Hello all,

I am running HP-UX 11.00. How do I tell ipfilter to block NIS ypserv connections? ypserv is given a different port by portmap each time NIS starts.

I know about /etc/securenets but I am actually running NIS+ which doesn't use this file. I need to block all ypserv connections from out side of our subnet.

Any info will be appreciated.

Thanks,
Steven

[Ron Kinner]

Can't you lock ypserv to a port? From the man on ypserv:

" -p --port port
ypserv will bind itself to this port. This makes it possible to have a router filter packets to the NIS ports, so that access to the NIS server from hosts on the Internet can be restricted."

Then it should be easy to block them.

Ron

[Steven Whatley]

I am actually running NIS+ and after talking with HP ITRC support, we could not come up with any way to lockdown the nisd daemon to a specific port. Acually, nisd listens on two ports because we are running NIS+ in YP-compatability. nisd seems to be getting its port numbers from RPC's portmapper. :(

Thanks,
Steven

[Steven Whatley]

I have fixed the problem. I installed and comfigured IPFilters last night.

The problem is that other networks at our company could see our NIS+ domain. A security audit was performed a few weeks ago and it was found that our passwd file potentially could be read because we are running NIS+ in YP compatabiity mode. The reason we enabled this mode is because we have some Alphas running Tru64 which does not support NIS+. So, the normal NIS tricks like setting up an /etc/securenets file doesn't work with NIS+. Plus, I could not find a way (nor could HP) to lock down the ports that NIS+ uses.

I am now able to block just the two nisd ports eventhough the port numbers change each time NIS+ is started. I created a simple perl script that is called from the /sbin/init.d/nisplus.server start/stop script. The Perl script runs "rpcinfo -p | grep nisd", extracts the two port numbers, and writes a file called "/etc/ipf-nisplus.conf". The nisplus.server script then does an 'ipf -f /etc/ipf-nisplus.conf' in the start) section. Also, the nisplus.server script does an 'ipf -r -f /etc/ipf-nisplus.com' in the stop) section.

The /etc/ipf-nisplus.conf file looks like:

block in log from any to any port = 700
pass in from xxx.yyy.zzz.0/24 to any port = 700
block in log from any to any port = 701
pass in from xxx.yyy.zzz.0/24 to any port = 701

Of course, the port numbers will be different each time.

Does this kludge sound like a reasonable solution to the prblem?

Thanks,
Steven