strange portmap requests

[Susan Markley]

Hi,
I have a machine 11.00 that for some reason is sending portmap requests to a machine. Here is the error that the outside machine is logging:
Feb 9 15:40:48 outsidemachine portmap[7169]: connect from x.x.x.x to getport(status): request from unauthorized host

x.x.x.x is the my 11.00 machine. The only point of interest is that the name of the outside machine used to be the name of my 11.00 machine. My feeling is that somewhere there is a config file that has the old name in it but I have looked everywhere. DNS, /etc/hosts, and NIS' hosts files all report the correct IP -> name.

Any help or suggestions would be much appreciated.
Thanks,
Susan

[Steven Sim Kok Leong]

Hi,

Give lsof a try. Run lsof and grep for the outside machine's hostname and IP address on your local machine. If you run it when the remote RPC was made, there is a chance that you will be able to identify the process that is opening this socket connection along with the opened files (may possibly include the configuration file) used by this process.

Hope this helps. Regards.

Steven Sim Kok Leong
Brainbench MVP for Unix Admin
http://www.brainbench.com

[Berlene Herren]

I thought portmap was replaced by rpcbind on 11.0?

Check and ensure you have only one netconf under /etc/rc.config.d (no backups or saved versions, they count also).

Berlene

[Brian Hackley · Accepted solution]

Hi,

Just an additional thought to go check /var/statmon/sm.bak for an entry corresponding to the remote host. If present, remove the file. rpc.statd is most likely trying to contact the status monitor on the remote host if that is the case. Less likely would be an entry in the /var/statmon/sm directory. Stopping rpc.statd / rpc.lockd and restarting them is recommended after doing this, but that restart can be delayed until a later time in case you have other active file locking in progress (e.g. users with $HOME mounted over NFS and using ksh history file).

Hope this helps,
Brian

[Susan Markley]

I checked and I do have a file in /var/statmon/sm.bak which has the outside machine's name in it. Before I delete and restart, I want to find out why it is there. The man says that it is created by rpc.statd. Does anyone know why it would create such a file? I am afraid that there is a config file somewhere and I'll reboot and the file will be back again...

Thanks for all your help,
Susan

[Susan Markley]

I deleted the file in /var/statmon/sm.bak and it is now working fine.
Thanks for your help,
Susan