rpcbind

[Thomas Jagoditsch]

in one of our (lazy infrequent) security scans we stumbled upon a running rpcbind. it seems that it was installed around 8.0.4.

trying to remove it tells us that pve depends on it:

The following packages will be REMOVED:
  libpve-guest-common-perl* libpve-storage-perl* nfs-common* proxmox-ve* pve-container* pve-ha-manager* pve-manager* qemu-server* rpcbind*

what is the use case for rpc in this context ?
can we block it via iptables and/or hosts.allow ?
do we need access to rpc from other nodes in the cluster ?

tia,tja...

 

[jlauro]

I don't know about all the other dependencies, but nfs requires it and I think some of the features of proxmox is supporting NFS.
If no one knows the answer, and not using nfs, it might be safe to block if this seems like a new requirement.
You could set iptables to ALLOW and do a rolling reboot the nodes (portmaps often only hit at startup), and do various operations and then check the count to see if the rule is hit.

Either way, you should be able to limit it with iptables so only the proxmox nodes (and any nfs servers or clients) have access.