System administration note

[mdlbear]

If you want to put a firewall on an NIS (Sun "Yellow Pages") server, you have to start ypserv with an explicit port number -- otherwise it just picks one at random! What were they thinking? Has anybody hit Sun with a clue-by-four yet?

Comments

rpc.portmap

[aerowolf.livejournal.com]

The rpc.portmapper is the server that tells exactly what port the service is on. And here's what they were thinking:

Eventually, there are going to be so many services running that there will be no way to run an "assigned port" scheme. Thus, they created the 'portmapper' concept -- register a service name with the portmapper, and what port you've got, and then any client that wants to use your service asks the portmapper what port you're on, using your registered name. It picks one at random so as to reduce the incidence of a port collision (bind() failure).

This is actually in one of the RFCs about NFS, as I recall. It makes sense in a strange sort of way, but they didn't think about firewalls back then.

Re: rpc.portmap

[mdlbear]

Figured it was something like that. And of course now you get the opposite problem -- everything gets shoved onto HTTP using SOAP to avoid getting firewalled, so there's no good way to discriminate between services in case you want to block only one.

Re: rpc.portmap

[aerowolf.livejournal.com]

Aye. There's a very appropriate quote here:

"The Internet views censorship as damage and routes around it."

Re: rpc.portmap

[penngwyn.livejournal.com]

Yeah, "applications security can't be trusted to the network guys", or some such blather.

(I recall that Gates' personal magnum opus, MS BASIC, embodied the philosophy that it not only knew better than the user and the programmer, it also knew better than the folks who built the hardware. Feh.)