sunrpc - post two for me today...

I'm running RH7.3 2.4.18-3 on an intel box as a firewall/squid proxy. I ran
nmap on it and found that sunrpc keeps showing up. Portmap is turned off,
and nfs is turned off. What else would keep sunrpc open? I've done a ton of
google, but no answers that helped ( most said thier problem was fixed by
turning portmap off...).

How do I turn off that accursed sunrpc?

Thanks - D
--
----------------------------------------
Drew McBee
Network Administrator
Tradesmen International

----------------------------------------
** Opinions expressed here are my own and not that of my employer **
----------------------------------------

Gblx News wrote:
> I'm running RH7.3 2.4.18-3 on an intel box as a firewall/squid proxy. I ran
> nmap on it and found that sunrpc keeps showing up. Portmap is turned off,
> and nfs is turned off. What else would keep sunrpc open? I've done a ton of
> google, but no answers that helped ( most said thier problem was fixed by
> turning portmap off...).
>
> How do I turn off that accursed sunrpc?
>
> Thanks - D

lsof - list open files
"-i" switch will show you internet sockets in use

# lsof -i
<snip>
xinetd 4026 root 7u IPv4 23887 UDP *:tftp
apache 27711 root 16u IPv4 2649 TCP *:www (LISTEN)
</snip>

look into man page for more options.
I dont think Redhat installs lsof as part of base install, so you will
have to isntall rpm.

"Gblx News" <dont_spam_me@reply_to_group_instead.org> wrote in message
news:(E-Mail Removed)

> I'm running RH7.3 2.4.18-3 on an intel box as a firewall/squid proxy.
> I ran nmap on it and found that sunrpc keeps showing up. Portmap is
> turned off, and nfs is turned off. What else would keep sunrpc open?
> I've done a ton of google, but no answers that helped ( most said
> thier problem was fixed by turning portmap off...).
>
> How do I turn off that accursed sunrpc?

"chkconfig --list" will show in what runlevels things will start/stop. If
portmap is turned off, then the currently running portmap must be
terminated. As someone else mentioned, "lsof -i :111" will indicate the PID
of the currently running portmap. You can either kill it explicitly, or mo'
bettah "/etc/init.d/portmap stop"


tony


--
use hotmail for any email replies



-----= Posted via Newsfeeds.Com, Uncensored Usenet News =-----
http://www.newsfeeds.com - The #1 Newsgroup Service in the World!
-----== Over 100,000 Newsgroups - 19 Different Servers! =-----

WELL -

lsof -i:111 gives me nothing. I know portmap isn't running as theres'
nothing in chkconfig and when I try to stop it, it fails ( as it should,
since it isn't running ). AND I'm scanning an external ip#/port from inside
my network - if THAT has anything to do with it.... I'm using nmap to
portscan, maybe an nmap anomolie -? Or is that blasphemy?
Regardless, I don't think it represents a security issue, since the service
clearly isn't working anyway.But I'd like to make it go away...

-D


"ynotssor" <"ynotssor"> wrote in message
news:(E-Mail Removed)...
> "Gblx News" <dont_spam_me@reply_to_group_instead.org> wrote in message
> news:(E-Mail Removed)
>
> > I'm running RH7.3 2.4.18-3 on an intel box as a firewall/squid proxy.
> > I ran nmap on it and found that sunrpc keeps showing up. Portmap is
> > turned off, and nfs is turned off. What else would keep sunrpc open?
> > I've done a ton of google, but no answers that helped ( most said
> > thier problem was fixed by turning portmap off...).
> >
> > How do I turn off that accursed sunrpc?
>
> "chkconfig --list" will show in what runlevels things will start/stop. If
> portmap is turned off, then the currently running portmap must be
> terminated. As someone else mentioned, "lsof -i :111" will indicate the
PID
> of the currently running portmap. You can either kill it explicitly, or
mo'
> bettah "/etc/init.d/portmap stop"
>
>
> tony
>
>
> --
> use hotmail for any email replies
>
>
>
> -----= Posted via Newsfeeds.Com, Uncensored Usenet News =-----
> http://www.newsfeeds.com - The #1 Newsgroup Service in the World!
> -----== Over 100,000 Newsgroups - 19 Different Servers! =-----

"Gblx News" <dont_spam_me@reply_to_group_instead.org> wrote in message
news:(E-Mail Removed)

> lsof -i:111 gives me nothing. I know portmap isn't running as theres'
> nothing in chkconfig and when I try to stop it, it fails ( as it
> should, since it isn't running ). AND I'm scanning an external
> ip#/port from inside my network - if THAT has anything to do with
> it.... I'm using nmap to portscan, maybe an nmap anomolie -? Or is
> that blasphemy? Regardless, I don't think it represents a security
> issue, since the service clearly isn't working anyway.But I'd like to
> make it go away...

lsof must be run on the machine being being queried, and it must be run as
root. A normal user will not be able to query the port info.


--
use hotmail for any email replies



-----= Posted via Newsfeeds.Com, Uncensored Usenet News =-----
http://www.newsfeeds.com - The #1 Newsgroup Service in the World!
-----== Over 100,000 Newsgroups - 19 Different Servers! =-----