18

As far as I understood rpcbind is used for listing active services, and telling the requesting client where to send the RPC request. If a host listens on port 111, one can use rpcinfo to get program numbers and ports and services running; For example look at below:

root@bt:~# rpcinfo -p x.x.x.x

program vers proto port

100001    2   udp    111  portmapper
100000    3   udp    111  portmapper        
100005    3   udp   1048  mountd
100022    1   tcp   1047  nlockmgr    
100021    4   udp   1047  nlockmgr
100026    1   tcp   1039  status
100029    1   udp   1039  status
100003    2   tcp   2049  nfs
100003    3   tcp   2049  nfs

What is the security risk of it?

Where we usually need to open port 111 and when can we close it without any other services fail?

  • Do you mean to have it open so that other systems can access port 111? There's a difference between localhost access and remote access. – schroeder Feb 3 '15 at 20:27
  • I mean open it so other hosts can access it. – Goli E Feb 3 '15 at 20:59
17

If you expose this service to the internet, everybody can query this information without having to authenticate. It can be useful to attackers to know what you have running.

Also, the RPC service has a history of security vulnerabilities. So don't expose it to the world unless you have to.

  • What if it is only internally exposed? – Goli E Nov 12 '15 at 18:24
  • 4
    Then the risk is limited to attackers who already have access to the internal network, either because they are internal users, or because they have breached something else. – Mark Koek Dec 9 '15 at 12:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.