Subject: Binding RPC services to specific ports
To: None <tech-security@NetBSD.org>
From: Luke Mewburn <lukem@NetBSD.org>
List: tech-security
Date: 07/18/2005 13:21:48
--mvzZjokS1nTZS3h1
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi all:

A feature that I've often desired is the ability to force
specific RPC services to be bound to specific TCP/IP ports.

I'd prefer a generic solution to this rather than hacking
each rpc daemon to support a "hardcode this port".

I did a little bit of research and found that IRIX 6.5.20
added /etc/rpcports -- as documented in their rpcports(4) at:
	http://techpubs.sgi.com/library/tpl/cgi-bin/getdoc.cgi?coll=3D0650&db=3Dma=
n&fname=3D/usr/share/catman/p_man/cat4/rpcports.z

The syntax of IRIX's /etc/rpcports is each line is
	program  transport  port  access
(or empty or a comment line starting with '#')

Each line:
	program		RPC program number (see rpc(4)), or the
			capitalized keyword ANY.
	    [NetBSD uses rpc(5)]

	transport	Transport name, either udp or tcp.
	    [NetBSD also supports udp6/tcp6 ?]

	port		Port, or port range expressed as a pair of
			ports separated only by a ``-'' character,
			without any space or tab characters.
			A port is specified numerically.
	    [Couldn't we support port names here?]

	access		Whether the port or port range is available,
			either ``allow'' or ``deny''.
		=09

Do people know of other prior art in this area?

Comments about adding this style of functionality to NetBSD?

Cheers,
Luke.

--mvzZjokS1nTZS3h1
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (NetBSD)

iD8DBQFC2yBMpBhtmn8zJHIRAtc3AKDAtpKelETZUXsZaKI2EKzJU5BzRQCfW/mQ
k6GiblWLR7pA6TOvCsT/P5Q=
=3TsS
-----END PGP SIGNATURE-----

--mvzZjokS1nTZS3h1--