Troels Arvin wrote on Wednesday 11 August 2004 16:50:
> On desktop systems, I can't get rid of portmap because fam needs it.
> - And I can't even stop portmap because a well-working fam is nice.
> As I don't use NFS or NIS on my desktop, either, I've long wanted to
> be able to tell portmap to bind to the loopback interface only,
> following a security principle of making daemons listen to the least
> possible interfaces. There doesn't seem to be a way to do that, so
> I've tried creating an altered portmap package. I'm no great c-coder,
> but it seems to work (even though there could be some IPv6 issues?).
portmap uses tcp-wrappers, so you can use /etc/hosts.{allow,deny} to
control which packets you process. Yes, portmap still listens on all
interfaces, but if I understand tcp-wrappers correctly, portmap won't
be asked to process any disallowed packets.
David
