Subject: Re: NIS+ --- How much of a win?

From: [email-masked] (Ruth Milner)
Date: Wed, 18 May 94 23:34:44 GMT

In article <[email-masked]> [email-masked] (Pete Hartman) writes:
>[email-masked] (Ian G Batten) writes:
>>Does NIS+ offer serious advantages?  We don't currently have
>>``problems'' with NIS, and we're quite happy adding extra maps for all
>>sorts of handy purposes.
>
>You may not have problems you are aware of, but be aware that anyone
>can snag your password hashes and run crack against them, and voila
>then have access to any number of your accounts, from which they could
>launch more damaging attacks on your site or other sites.

This is actually pretty old. There was a patch issued for this problem for 
SunOS 4.1(.x) nearly two years ago, and - while I haven't seen the package -
it should also be built into the NIS server kit for SunOS 5.x . Be sure you 
are making use of the /var/yp/securenets file on all your NIS servers (master
or slave) to restrict access.

Since this is IP-address-based, it is subject to spoofing. I don't know how 
easy that is to do over the main Internet links, given routing issues, but
you may also want to try to block routing from outside your local net on the 
ports that NIS uses. That would limit the potential for spoofing considerably. 
However, it would affect routing performance if you don't already have
filtering turned on.

Now this starts to get a bit weird. :-)

The port numbers for these services appear to be assigned at boot time and 
vary somewhat, but ypbind always seems to use 1027 for udp under SunOS 4 
(I checked 85 systems). The tcp ports I see are all in the range 1024-1166. 
I have no idea if anything else *common* uses ports in this range; nothing is 
listed either in /etc/services or by rpcinfo, so I suspect not. According to 
the ypclnt(3n) man page, all NIS transactions except one (yp_all) use UDP. 
I don't know how often yp_all is used; anyone?

SunOS 5.3 is a bit different. The ypclnt man page still says everything
except yp_all uses UDP, but as we already know :-(, not all the man pages got 
changed to reflect real Solaris 2 behavior. Also, the UDP port does vary, on 
6 systems I saw a 50/50 split between 32787 and 32790. The TCP port was always
32771, but of course this is a small sample.

Does anyone know of a good way to block outside traffic on ypbind-related 
ports without affecting other services? Is there much point in worrying about 
the variable numbers if you get the set ones? I'd love to know the answers
to these questions. :-)

Thanks!
-- 
Ruth Milner                          NRAO/VLA                  Socorro NM
Manager of Computing Systems    [email-masked]

---

From: [email-masked] (Casper H.S. Dik)
Date: 19 May 1994 08:36:31 GMT

>I don't know how often yp_all is used; anyone?

You should use ypbind -s, which binds to a port < 1024.  The reason why
you should do this is pretty simple: now a user can start his own
version of ypbind that points to a rogue server.  After a while clients
will use that server, instead of your own server.  Obviously, getting
full access to your system is easy from then on.  Secondly, if you
don't run ypbind -s, ypbind will accept servers with port numbers >= 1024
so some devious individual can start his own ypserv on one of the
hosts that isn't a NIS server.  This all applies to ONC RPC 4.0.

This is not true in Solaris 2.x (TLI RPC) where you can never
reregister a service belonging to another user.  TLI gives anough user
identification to rpcbind to make that possible.

>32771, but of course this is a small sample.

Almost all yp services can use tcp.  Ypcat will use TCP/IP, but it
does probably use yp_all.  You can write your own with yp_first and yp_next,
but over TCP/IP.  In fact, you can call all NIS services over tcp/ip.

>the variable numbers if you get the set ones? I'd love to know the answers

You don't have to filter ypbind.  Ypbind is just a pointer to ypserv.
Once you filter ypserv, access to ypbind doesn't do you any good.

You'll need to filter ypser and ypxfrd only.  Those should always
live on ports 512 < port < 1024, because clients request that they are
bound to ports < 1024 (but only when ypbind runs with -s, but the server
doesn't know about it's clients so it has to bind < 1024 all the time).

The main reason for the servers needing to run <

Casper