[SunRescue] FW: RE: http://www.cert.org/advisories/CA-2000-17 .htmlandSolaris...

[ed_mitchell at adc.com]

There are other things that will cause entries to show up in rpcinfo.  For
example, OpenWin.  As far as I understand rpcbind, the output of rpcinfo is
going to be dynamic, based on what services you start up and/or stop.  I.E.
if you kill off NFS, that service should become 'unregistered' from
rpcbind.

Try running rpcbind with -d option.

Ed



From: Jonathan Katz <jon at jonworld.com> on 08/21/2000 10:08 PM GMT

Please respond to rescue at sunhelp.org

To:   rescue at sunhelp.org
cc:    (bcc: Ed Mitchell/US/Centigram)
Subject:  RE: [SunRescue] FW: RE:
      http://www.cert.org/advisories/CA-2000-17.htmlandSolaris...




Mike wrote:

:1) newbie != confused :-P  Well...not always anyway.

I know, I'm just dishing it out ;^)

:2) Here's the output from 'rpcinfo -p localhost':

[ truncated ]

Since you're doing NIS+ stuff and NFS stuff (I'm assuming) plus
DiskSuite stuff you need to leave RPC on.

:    100011    1   udp  32794  rquotad

Are you using quotas? You can turn that off...

:    100002    2   udp  32795  rusersd
:    100002    3   udp  32795  rusersd
:    100002    2   tcp  32806  rusersd
:    100002    3   tcp  32806  rusersd
:    100012    1   udp  32796  sprayd
:    100008    1   udp  32797  walld

You can turn all that stuff, off, too. Do you want people duiong
'rusers' on your network and running 'wall'

:    150001    1   udp   1013  pcnfsd
:    150001    2   udp   1013  pcnfsd
:    150001    1   tcp   1014  pcnfsd
:    150001    2   tcp   1014  pcnfsd

pcnfsd isn't really needed, is it? (Are you running pcnfs?)

:My problem is that I'm too newbyish (newbish?) to know what to look for.

Don't sweat it. My theory is "if it looks like it is wasting CPUs, why
am I running it?"

:Oh, and BTW, the server is up to date on 2.6 patches as of last week.
I'll
:be upgrading to 2.7 next week some time so I will patch more this weekend.
:Then Solaris 8 some time later in the year.

Yahoo!

:I am running Solstice from a Classic being used as a remote X-Terminal.
I'm
:only running Solstice because I don't know enough about NIS+ to properly
:admin it.  (Working on it but can't seem to find a clear training path to
:learn it - book, CBT, _or_ class.)

Ahh, understood. I wish I had some of my ancient perl scripts to help you,
unfortunately I don't have them anymore.

:Regardless this is the first time I've had to deal with anything that
looks
:like a real attack.  The worst I've had over the years is SPAM on the mail
:server.  Unix newbie, never had to really deal with good security until
this
:year, first attack - you can see why I'm a little nervous about this.

It may just be Solactice acting buggy. Did you reboot or have troubles w/
your Classic?

:Poor Confused Mike

Awwwww!

-Jon
--
Jonathan Katz
e-mail: jon at jonworld.com
website: http://jonworld.com
proprietor: http://bachelor-cooking.com
Cell: 317-698-4023 * Pager: 800-759-8888 1770869 * FAX: 530-688-5347

_______________________________________________
Rescue maillist  -  Rescue at sunhelp.org
http://www.sunhelp.org/mailman/listinfo/rescue