As far as I understood rpcbind is used for listing active services, and telling the requesting client where to send the RPC request. If a host listens on port 111, one can use rpcinfo to get program numbers and ports and services running; For example look at below:

root@bt:~# rpcinfo -p x.x.x.x

program vers proto port

100001    2   udp    111  portmapper
100000    3   udp    111  portmapper        
100005    3   udp   1048  mountd
100022    1   tcp   1047  nlockmgr    
100021    4   udp   1047  nlockmgr
100026    1   tcp   1039  status
100029    1   udp   1039  status
100003    2   tcp   2049  nfs
100003    3   tcp   2049  nfs

What is the security risk of it?

Where we usually need to open port 111 and when can we close it without any other services fail?

  • Do you mean to have it open so that other systems can access port 111? There's a difference between localhost access and remote access.
    – schroeder
    Feb 3, 2015 at 20:27
  • I mean open it so other hosts can access it.
    – Goli E
    Feb 3, 2015 at 20:59

2 Answers 2


If you expose this service to the internet, everybody can query this information without having to authenticate. It can be useful to attackers to know what you have running.

Also, the RPC service has a history of security vulnerabilities. So don't expose it to the world unless you have to.

  • 1
    What if it is only internally exposed?
    – Goli E
    Nov 12, 2015 at 18:24
  • 5
    Then the risk is limited to attackers who already have access to the internal network, either because they are internal users, or because they have breached something else.
    – Mark Koek
    Dec 9, 2015 at 12:46
  • Good answer! +1 Jan 2, 2020 at 18:03

rpcbind can have an amplification factor of anywhere between x5 and x20 depending on the number of RPC services running.

It should not be exposed publicly or at least only allow whitelisted IP addresses otherwise you may find the server participating in DDoS attacks.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .