Re: How to configure npf to restrict nfs to localhost

[Hauke Fath <hf%spg.tu-darmstadt.de@localhost>]

On 2020-06-29 23:24, Greg A. Woods wrote:
> Stopping rpcbind from revealing ports other RPC servers are listening on
> is the primary thing you need to do.  You can do this with filters
> blocking TCP and UDP ports #111, and/or with rpcbind itself using its
> built-in libwrap support, like so:
>
> In your /etc/hosts.allow file you can restrict rpcbind to given
> networks:
>
> 	rpcbind:PARANOID:DENY
> 	rpcbind:0.0.0.0, 127.0.0.1, 10.0.1.0/255.255.255.0 :ALLOW
> 	rpcbind:ALL:DENY

In order for rpcbind(8) to actually heed /etc/hosts.{allow,deny} it 
needs to be started with

     -W      Enable libwrap (TCP wrappers) support.

which for whatever reason is not the default.

The default

     -l      Turns on libwrap connection logging.

will just log.

Cheerio,
Hauke

--
     The ASCII Ribbon Campaign                    Hauke Fath
()     No HTML/RTF in email	        Institut für Nachrichtentechnik
/\     No Word docs in email                     TU Darmstadt
     Respect for open standards              Ruf +49-6151-16-21344