Re: Firewalls and RPC (was "Re: Improvement to IPFilter / nfsd in FBSD (6.2+?)")

On Jan 11, 2007, at 12:54 PM, Garrett Cooper wrote:
It is typically not useful to implement firewall rules between NFS servers and legitimate NFS clients.

The large number of RPC services using randomly assigned ports needed by NFS and the fact that machines which trust each other enough to permit filesharing and generally utilize a common set of directory services to keep the user/group mappings synced mean that the NFS server & clients should be considered in the same "trust domain" in most cases.

Right, ok. I suppose I was just being lazy/trying to blanket support all machines on my subnet without having to delve into individual hosts, but that makes perfect sense. rpcbind (and RPC in general) strictly uses ports under 1023--assuming that there are enough allocatable ports available for each RPC service in the port range 1-1023--if running as root, does it not?

Actually, no. While rpcbind/portmap/portmapper is assigned to 111/ tcp & udp, most other RPC services get assigned high port numbers in the 327xx range, but that varies considerably from platform to platform.

Does the same rationale apply for Samba? That's part of the reason why I'm concerned with running a firewall.. I run smbd/nmbd on the server machine.

Somewhat, yes. Samba/CIFS filesharing can require less trust between server and client as accessing a Samba share does not require superuser permissions, just limited user access, but Samba does require root access to start up and bind to the low ports it uses, and it also involves the "network browse master" (which nmbd can do) and so forth which involve subnet-oriented broadcast traffic.

Samba/CIFS is a chatty protocol.

Either that, or I could switch to another firewall setup (albeit it'd be sort of a pain). Does ipfw / pf work better with RPC than IPFilter?

No, not really. What you probably want to focus on is protecting your entire subnet, including the fileserver and clients, from malicious traffic via your Internet link(s), and then worry about egress filtering, dividing your machines into a trusted internal LAN and a semi-trusted DMZ, and so forth.

A firewall system should not be running any kind of filesharing; while you can run PF, IPFW, etc on your fileserver, that ought to be a secondary line of protection for "defense in depth", and your Internet connection ought to have a dual-homed or multihomed firewall machine which is dedicated to that role and which runs zero services.

--
-Chuck

_______________________________________________
freebsd-questions@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: Open Ports
    ... want the ports open even ifs all in house and behind the hardware firewall??? ... it opens up in demo mode. ... server is Cisco Catalyst Express 500 switches for voice over IP. ... will take requests from the clients. ...
    (microsoft.public.windows.server.general)
  • Whos blocking these ports? Please help...
    ... server - one is called Vicomsoft Internet Gateway (proxy server, ... IG basically takes over the TCP/IP routing and does this using ... Each of these ports uses a NIC in the server. ... All the clients are assigned IPs ...
    (microsoft.public.win2000.security)
  • Re: Servers & Routers and Firewalls, Oh my....
    ... This will ensure that the external NIC of the server ... The router, which is> connected to NIC1 is running DHCP so NIC1 can pull an IP> from it. ... The router has> certain ports open and allowing traffic to the IP that> the server pulled. ... > Now, when clients try to use programs that needs those> ports, it's acting like they are not open. ...
    (microsoft.public.windows.server.sbs)
  • RE: Remote access issue: Unable to add the interface...
    ... When you are on the outside of the LAN and connect to the server how do you ... open for RWW to work to the clients. ... Incoming ports that should NOT be open ... Routing and Remote Access service seems to be running fine, ...
    (microsoft.public.windows.server.sbs)
  • Re: Whats a decent modem/router for tech savy user?
    ... It is not possible to route or deny traffic to specific ports based on the source IP address. ... But it wont route back inside the LAN - needs internal DNS server spoofing. ... Normally, this option should be Enabled, so that an Internet connection will be made automatically, whenever Internet-bound traffic is detected. ... Specifying a Default DMZ Server allows you to set up a computer or server that is available to anyone on the Internet for services that you haven't defined. ...
    (uk.telecom.broadband)