[OE-core] [PATCH] rpcbind: add option to fix port number
Li.Wang
Li.Wang at windriver.com
Tue Aug 12 08:44:18 UTC 2014
Hi,
this is a description from customer:
=====
customer's description of the problem:
"
It would seem rcpbind opens a random port.
Clearly not the most simple thing to protect with an ipfilter.
Opening random ports in privileged port range, among them one port
that
identifies itself as pop3s, is not a good practice. Both Ericsson
and our
customers run regular vulnerability assessment tools against our
product,
and this will clearly be seen as a potential problem. Furthermore,
we will
not be able to filter the ports, since they are random, and neither
will we
be able to provide decent answers to our customers. To summarize: this
should be taken care of, ie fix rpcbind so that it uses a non
random port
and/or to bind to a specific interface.
=====
Thanks,
LiWang.
On 08/12/2014 04:41 PM, Burton, Ross wrote:
> On 12 August 2014 08:20, Li Wang <li.wang at windriver.com> wrote:
>> fix a random port to offer customer an option for select.
> I'm curious as to why this is needed.
>
> Ross
More information about the Openembedded-core
mailing list