System administration note

[mdlbear]

If you want to put a firewall on an NIS (Sun "Yellow Pages") server, you have to start ypserv with an explicit port number -- otherwise it just picks one at random! What were they thinking? Has anybody hit Sun with a clue-by-four yet?

Comments

Re: rpc.portmap

[mdlbear]

Figured it was something like that. And of course now you get the opposite problem -- everything gets shoved onto HTTP using SOAP to avoid getting firewalled, so there's no good way to discriminate between services in case you want to block only one.

Re: rpc.portmap

[aerowolf.livejournal.com]

Aye. There's a very appropriate quote here:

"The Internet views censorship as damage and routes around it."

Re: rpc.portmap

[penngwyn.livejournal.com]

Yeah, "applications security can't be trusted to the network guys", or some such blather.

(I recall that Gates' personal magnum opus, MS BASIC, embodied the philosophy that it not only knew better than the user and the programmer, it also knew better than the folks who built the hardware. Feh.)