skullnobrains
asked on
why does nfsv4 client open an extra port ? how to close it if it is actually useless ?
why does nfsv4 client open an extra port ? how to close it if it is actually useless ?
hello, all
i'm working with an ubuntu ( xenial ) bunch of servers and need to understand why mounting an nfs v4 share opens a random port on the client side. the port has no associated process and seems to be directly open by the nfs kernel module. the port is closed if i unmount and a different one is opened if i remount the share. no traffic ever hits that port neither when mounting nor afterwards ( possibly because the share is read-only ).
nmap reports the port ( the number ????? changes from time to time using an apparently random high range port ) as :
PORT STATE SERVICE VERSION
?????/tcp open fmproduct 1-4 (RPC #1073741824)
as far as i remember, nfsv4 does not need a port mapper to work so i don't really get the point of whatever RPC service is open on the client side. is that correct ?
if the above is correct, anybody knows how to instruct ubuntu not to open that port ?
( please don't tell me to use the firewall or hosts.deny : i do not want the port to be open in the first place )
thanks all
hello, all
i'm working with an ubuntu ( xenial ) bunch of servers and need to understand why mounting an nfs v4 share opens a random port on the client side. the port has no associated process and seems to be directly open by the nfs kernel module. the port is closed if i unmount and a different one is opened if i remount the share. no traffic ever hits that port neither when mounting nor afterwards ( possibly because the share is read-only ).
nmap reports the port ( the number ????? changes from time to time using an apparently random high range port ) as :
PORT STATE SERVICE VERSION
?????/tcp open fmproduct 1-4 (RPC #1073741824)
as far as i remember, nfsv4 does not need a port mapper to work so i don't really get the point of whatever RPC service is open on the client side. is that correct ?
if the above is correct, anybody knows how to instruct ubuntu not to open that port ?
( please don't tell me to use the firewall or hosts.deny : i do not want the port to be open in the first place )
thanks all
Last Comment
ASKER CERTIFIED SOLUTION
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
ASKER
confirmed, thanks : changing sysctl fs.nfs.nfs_callback_tcppor
i clearly do not want the corresponding behavior in this context
would you happen to know how to disable the feature altogether client-side ?
i clearly do not want the corresponding behavior in this context
would you happen to know how to disable the feature altogether client-side ?
I’m not sure if you can disable this, but I don’t see the need. If the firewall blocks the callback port, nfs will detect this and automatically disable delegations.
ASKER
my goal is to prevent programs from opening sockets and run as privileged users unless there is an actual need. i have no time to fully audit but am reluctant to trust the delegation mechanism to be even mildly difficult to exploit somehow and do not want to rely on the firewall to block loopback connections.
thanks for your help so far. i'll close this thread once i'll have time to find a decent/dumb way to achieve my secondary goal. and obviously accept your answer. thanks.
thanks for your help so far. i'll close this thread once i'll have time to find a decent/dumb way to achieve my secondary goal. and obviously accept your answer. thanks.
SOLUTION
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
ASKER
i REALLY thought i had closed this question weeks ago.
i guess the sliding semi-transparent ad-like windows10-UI-like confirmation not-a-window was too weird for me to figure out i was supposed to click "next" ... which i was reluctant to do, since next involves a series of different clicks and questions.
i guess the sliding semi-transparent ad-like windows10-UI-like confirmation not-a-window was too weird for me to figure out i was supposed to click "next" ... which i was reluctant to do, since next involves a series of different clicks and questions.
Linux
Linux is a UNIX-like open source operating system with hundreds of distinct distributions, including: Fedora, openSUSE, Ubuntu, Debian, Slackware, Gentoo, CentOS, and Arch Linux. Linux is generally associated with web and database servers, but has become popular in many niche industries and applications.
71K
Questions
--
Followers
--
Top Experts
Get a personalized solution from industry experts
TRUSTED BY
ASKER
tcpdump shows no connection attempt ( sniffing the traffic originating from the server on the client )
this is a recap of sniffed packets while performing unmount + mount + list directory operations
Open in new window
notice that every SYN packet is sent by depl101 ( nfs client ) to nas-dist (server ) on the NFS port
the extra opened port ( actually ports since it changes when unmounting + remounting ) do not even appear in the sniffed traffic