Detections
Analytics

2.2.6 Ensure rpcbind services are not in use

Information

The rpcbind utility maps RPC services to the ports on which they listen. RPC processes notify rpcbind when they start, registering the ports they are listening on and the RPC program numbers they expect to serve. The client system then contacts rpcbind on the server with a particular RPC program number. The rpcbind redirects the client to the proper port number so it can communicate with the requested service.

Portmapper is an RPC service, which always listens on tcp and udp 111, and is used to map other RPC services (such as nfs, nlockmgr, quotad, mountd, etc.) to their corresponding port number on the server. When a remote host makes an RPC call to that server, it first consults with portmap to determine where the RPC server is listening.

A small request (~82 bytes via UDP) sent to the Portmapper generates a large response (7x to 28x amplification), which makes it a suitable tool for DDoS attacks. FreeBSD ships with rpcbind in the base system and is by default disabled.

Solution

Run the following commands to stop and disable rpcbind :

# service rpcbind onestop
# service rpcbind onedisable

See Also

https://workbench.cisecurity.org/benchmarks/19044

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Unix

Control ID: cf4296281a8a222be6246004a5d43003c99166e553dcac3c85cac3e234d41d16