From nobody@FreeBSD.ORG Tue Jun 22 08:19:48 1999
Return-Path: <nobody@FreeBSD.ORG>
Received: by hub.freebsd.org (Postfix, from userid 32767)
	id 2BDE915171; Tue, 22 Jun 1999 08:19:48 -0700 (PDT)
Message-Id: <19990622151948.2BDE915171@hub.freebsd.org>
Date: Tue, 22 Jun 1999 08:19:48 -0700 (PDT)
From: grandi@noao.edu
Sender: nobody@FreeBSD.ORG
To: freebsd-gnats-submit@freebsd.org
Subject: /etc/hosts.allow must use numerical IP addresses when protecting portmap
X-Send-Pr-Version: www-1.0

>Number:         12342
>Category:       conf
>Synopsis:       /etc/hosts.allow must use numerical IP addresses when protecting portmap
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    sheldonh
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Jun 22 08:20:00 PDT 1999
>Closed-Date:    Thu Jun 22 06:05:38 PDT 2000
>Last-Modified:  Thu Jun 22 06:06:32 PDT 2000
>Originator:     Steve Grandi
>Release:        FreeBSD 3.2-STABLE
>Organization:
National Optical Astronomy Observatories
>Environment:
FreeBSD noao.edu 3.2-STABLE FreeBSD 3.2-STABLE #6: Thu Jun 10 12:22:41 MST 1999
     grandi@noao.edu:/usr/src/sys/compile/NOAO
>Description:
In /usr/src/usr.sbin/portmap/pmap_check.c, in a comment at the beginning
concerning  -DHOSTS_ACCESS, we find:

  * If compiled with -DHOSTS_ACCESS, reject requests from hosts that are not
  * authorized by the /etc/hosts.{allow,deny} files. The local system is
  * always treated as an authorized host. The access control tables are never
  * consulted for requests from the local system, and are always consulted
  * for requests from other hosts. Access control is based on IP addresses
  * only; attempts to map an address to a host name might cause the
  * portmapper to hang.

However, the examples in /etc/hosts.allow use host names when dealing
with the portmap.
>How-To-Repeat:
Try to use a hostname when protecting portmap in /etc/hosts.allow
>Fix:
--- hosts.allow Tue May 11 02:52:05 1999
+++ hosts.allow.NEW     Tue Jun 22 08:17:30 1999
@@ -33,9 +33,11 @@
 sendmail : ALL : allow
 
 # Portmapper is used for all RPC services; protect your NFS!
-portmap : localhost : allow
-portmap : .nice.guy.example.com : allow
-portmap : .evil.cracker.example.com : deny
+#   NOTE: numercial IP addresses must be used for portmap.
+#   furthermore, local machine acceses are not checked against hosts.allow
+#portmap : 123.231.132/255.255.255.0 : allow
+#portmap : 123.222. : allow
+#portmap : 111.222.111.222 : deny
 portmap : ALL : allow
 
 # Provide a small amount of protection for ftpd


>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->analyzed 
State-Changed-By: sheldonh 
State-Changed-When: Tue May 16 08:13:08 PDT 2000 
State-Changed-Why:  
Rev 1.10 completes the fix for this one (thanks to Andy Farkas for 
the reminder).  I'll probably merge this next week. 



Responsible-Changed-From-To: freebsd-bugs->sheldonh 
Responsible-Changed-By: sheldonh 
Responsible-Changed-When: Tue May 16 08:13:08 PDT 2000 
Responsible-Changed-Why:  
Reminder for me. 
State-Changed-From-To: analyzed->closed 
State-Changed-By: asmodai 
State-Changed-When: Tue May 16 08:23:11 PDT 2000 
State-Changed-Why:  
Committed by sheldonh in rev 1.10 of /etc/hosts.allow 
State-Changed-From-To: closed->analyzed 
State-Changed-By: sheldonh 
State-Changed-When: Tue May 16 08:27:43 PDT 2000 
State-Changed-Why:  
Guess who isn't doing his reading? :-) 
State-Changed-From-To: analyzed->closed 
State-Changed-By: sheldonh 
State-Changed-When: Thu Jun 22 06:05:38 PDT 2000 
State-Changed-Why:  
Merged onto the RELENG_4 branch in rev 1.8.2.2 (5 May 2000) and 
onto the RELENG_3 branch in rev 1.2.2.8 (same date). 

http://www.freebsd.org/cgi/query-pr.cgi?pr=12342 
>Unformatted:
