Security

Ask something
Discussion Locked

Having Portmap instrusion problems

0 helpful
3 replies

by barry hensley 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have just installed my first Linux server. I am certainly a novice at Linux and need some help.

Shortly after installing RedHat 6.2 in its default server configuration, I am getting emails from people claiming that this machine is trying to break into their network. Most of them are saying that I am trying to break in on port 111 but serveral other ports have shown up as well.

I'm sure this is something simeple but I have not been able to find an answer anywhere.

3 replies

by brav0

Port 111 is used by the Sunrpc protocol(see /etc/services), which used by the portmap daemon. Portmap is a daemon used to handlde RPC services. RPC allows a program on one machine to call a subroutine on another machine without knowing that it is remote. (security risk??? um, yes)

If you do not run an NFS server or any other RPC programs you can remove portmap. To remove portmap you can do: "/etc/rc.d/init.d/portmaper stop"
as root.
Then go to the rc directory for your run level (/etc/rc.d/rc2.d and /etc/rc.d/rc3.d) and remove the symbolic link to the above file.

Also, take a look at Bastille Linux at http://www.bastille-linux.org/
It's an interactive Linux hardening script which will (among other things)
disable these services for you...
and check out the following link for more info: http://www.europe.redhat.com/documentation/HOWTO/NFS-HOWTO/security.php3

This discussion is closed to new replies.