Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I have found on my machine port 111 is open. This is listed as RPC.

I understand there are possible attacks on this port. How can my machine be attacked if port 111 is open?

How can I secure this port?

share|improve this question
Just politely asking: How do you know it is an rpc mechanism? Have you traced it to a specific process? – logicalscope Jul 15 '12 at 1:56
More information is needed if you want an answer. Perhaps an nmap version scan readout? – Terry Chia Jul 15 '12 at 1:59
2  
Discover what process is listening on that port. In a Gnu/Linux environment you could run "netstat -ntlp" as root. What operating system are you running? – chao-mu Jul 15 '12 at 16:12

closed as not a real question by symcbean, Scott Pack, Iszi, AviD♦ Aug 18 '12 at 20:36

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.

2 Answers

up vote 6 down vote

TCP and UDP ports 111 are the well-known ports for ONC RPC portmapper. Portmapper is analagous to DNS, in that an RPC server registers with the portmapper process on the machine they both run on. An RPC server gives the portmapper the port(s) on which the RPC server listens for requests, and the (hopefully unique) number that identifies the interface or contract that the RPC server provides.

A prospective RPC client queries the portmapper on port 111, giving it the number identifying the RPC server that the RPC client wishes to use. Portmapper gives back the TCP or UDP port(s) that the RPC server registered earlier. The RPC client then can contact the RPC server directly, leaving portmapper out of any further interactions.

If you don't have an ONC RPC server process running, then you probably shouldn't have portmapper running. The most common RPC server would have to be NFS, Sun's Network File System, but NIS and NIS+ also uses that RPC system. Portmapper code had suffered a few buffer overflows, but in general it was pretty rugged. I wouldn't run portmapper without running a server just on general principle: why waste CPU cycles on it, as well as give morons a target to try 25-year old exploits on?

share|improve this answer
up vote 4 down vote

Portmapper can allow an attacker to quickly determine if you run a vulnerable service. However, blocking portmapper isn't really sufficient since they can just call procedure 0 on open ports to find the services.

If you don't need external access to your onc rpc services, don't permit it.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.