On Tue, Jan 25, 2005 at 09:09:45PM -0800, Sandy Rutherford wrote:
> > But the question is how to get rpcbind to use tcp-wrappers
> > in the first place!
>
> > Because even with this in hosts.allow, sockstat -46l still
> > shows:
>
> > root rpcbind 10188 7 udp4 127.0.0.1:111 *:*
> > root rpcbind 10188 8 udp4 192.168.1.1:111 *:*
> > root rpcbind 10188 9 udp4 *:<some_random_port> *:*
> > root rpcbind 10188 10 tcp4 *:<some_random_port> *:*
>
> > So it's still binding to INADDR_ANY :-(
>
> > Am I missing something obvious, or is rpcbind not "tcp wrapped"
> > by default?
>
> Should be. Double check to make sure that /usr/sbin/portmap is linked
> to libwrap.
Good idea! Yes indeed, rpcbind is linked to libwrap:
/usr/sbin/rpcbind:
libwrap.so.3 => /usr/lib/libwrap.so.3 (0x28080000)
libutil.so.4 => /lib/libutil.so.4 (0x28088000)
libc.so.5 => /lib/libc.so.5 (0x28094000)
> I am not surprised that rpcbind is still bound to all of your
> interfaces. AFAIK, tcp-wrappers doesn't control which interface is
> being listened on, but rather it controls from which IP numbers
> connections will be accepted. This is what I meant, when I said that
> tcp-wrappers doesn't do exactly what you want. However, if you use
> tcp-wrappers to accept only connections from 192.168.1.0/255.255.255.0
> and configure a firewall on this host to block all connections to the
> interface in question from this address range, then you will end up
> with something approximating what you want.
Yes, that's approximatly what I had in mind.
Thank you for your help! :)
> ...Sandy
Cheers,
-cpghost.
--
Cordula's Web. http://www.cordula.ws/
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
