Appendix C
This appendix describes the Data ONTAP services file that is available in the /etc directory. The /etc/services file is in the same format as its corresponding UNIX systems /etc/services file. Although this file is it not used by Data ONTAP, it is provided in this appendix as information useful to system administrators.
Although some port scanners are able to identify storage systems as storage systems, others port scanners report storage systems as unknown types, UNIX systems because of their NFS support, or Windows systems because of their CIFS support. There are several services that are not currently listed in the /etc/services file.
Below is an example of a complete list of the file contents.
The nntp and ttcp ports are unused by your storage system and should never be detected by a port scanner.
The following ports are found on the storage system with NFS enabled:
On other systems, the ports appear as follows:
Enter the following command on UNIX systems to obtain the correct information by querying the port mapper on port 111:
toaster# rpcinfo -p storage.system.name.or.ip.address
program vers proto port service
100011 1 udp 608 rquotad
100021 4 tcp 607 nlockmgr
100021 3 tcp 607 nlockmgr
100021 1 tcp 607 nlockmgr
100021 4 udp 606 nlockmgr
100021 3 udp 606 nlockmgr
100021 1 udp 606 nlockmgr
100024 1 tcp 605 status
100024 1 udp 604 status
100005 3 tcp 603 mountd
100005 2 tcp 603 mountd
100005 1 tcp 603 mountd
100005 3 udp 602 mountd
100005 2 udp 602 mountd
100005 1 udp 602 mountd
100003 3 udp 2049 nfs
100003 2 udp 2049 nfs
100000 2 tcp 111 rpcbind
100000 2 udp 111 rpcbind
Note
The port numbers listed for mountd, statd, lockd, and quotad are not committed port numbers. Storage systems can have these services running on other port numbers. Because the system selects these port numbers at random when it boots, they are not listed in the /etc/services file.
The following ports appear in a port scan but are not listed in /etc/services file:
|
Legato ClientPack for your storage system runs on random UDP ports and is now deprecated. It is recommended that NDMP be used to back up your storage system using Legato Networker. |
Note
Disable open ports that you do not need.
File transfer protocol (FTP) uses TCP ports 20 and 21. For a detailed description of the FTP support for your storage system, see the Data ONTAP File Access and Protocols Management Guide. If you use FTP to transfer files to and from your storage system, the FTP port is required; otherwise, use FilerView or the following CLI command to disable the FTP port:
options ftpd.enable off
FTP is not a secure protocol for two reasons:
These user names and passwords can then be used to access data and other network resources. You should establish and enforce policies that prevent the use of the same passwords to access storage systems and other network resources.
Secure Shell (SSH) protocol is a secure replacement for RSH and runs on TCP port 22. This only appears in a port scan if the SecureAdminTM software is installed on your storage system.
There are three commonly deployed versions of the SSH protocol:
This vulnerability to attack lies in the SSH protocol version 1 itself and not in the associated storage system products.
To disable SSH support or to close TCP port 22, use the following CLI command:
secureadmin disable ssh
Telnet is used for administrative control of your storage system and uses TCP connections on port 23. Telnet is more secure than RSH, as secure as FTP, and less secure than SSH or Secure Socket Layer (SSL).
Telnet is not secure because:
Clear text format can be read by an attacker using a packet sniffer program. The attacker can use these user names and passwords to log in to your storage system and execute unauthorized administrative functions, including destruction of data on the system. If the administrators use the same passwords on your storage system as they do on other network devices, the attacker can use these passwords to access those resources as well.
Note
To reduce the potential for attack, establish and enforce policies preventing administrators from using the same passwords on your storage system that they use for access to other network resources.
Telnet is also vulnerable to the same type of TCP session attacks as SSH protocol version 1, but because a packet sniffing attack is easier, TCP session attacks are less common.
To disable Telnet, set options telnet.enable to off.
The Simple Mail Transport Protocol (SMTP) uses TCP port 25. Your storage system does not listen on this port but makes outgoing connections to mail servers using this protocol when sending AutoSupport e-mail.
Your storage system supports two different time service protocols:
When your storage system has option timed.enable set to On and a remote protocol (rdate or ntp) is specified, the storage system synchronizes to a network time server.
If the timed.enable option is set to Off, your storage system is unable to synchronize with the network time server using NTP. The rdate time protocol can still be used by manually issuing the rdate command from your storage system console.
You should set the timed.enable option to On in a cluster configuration.
The Domain Name Service (DNS) uses UDP port 53 and TCP port 53. Your storage system does not typically listen on these ports because it does not run a domain name server. However, if DNS is enabled on your storage system, it makes outgoing connections using UDP port 53 for host name and IP address lookups. Your storage system never uses TCP port 53 because this port is used explicitly for communication between DNS servers. Outgoing DNS queries by your storage system are disabled by turning off DNS support. Turning off DNS support protects against receiving bad information from another DNS server.
Because your storage system does not run a domain name server, the name service must be provided by one of the following:
DNS must be enabled for participation in an Active Directory domain.
Clients broadcast messages to the entire network on UDP port 67 and receive responses from the Dynamic Host Configuration Protocol (DHCP) server on UDP port 68. The same ports are used for the BOOTP protocol.
DHCP is used only for the first-time setup of your storage system. Detection of DHCP activity on your storage system by a port scan other than the activity during the first-time setup indicates a serious configuration or software error.
Trivial File Transfer Protocol (TFTP) uses TCP port 69. It is used mostly for booting UNIX or UNIX-like systems that do not have a local disk (this process is also known as netbooting) and for storing and retrieving configuration files for devices such as Cisco routers and switches.
Transfers are not secure on TFTP because it does not require authentication for clients to connect and transfer files.
Your storage system's TFTP server is not enabled by default. When TFTP is enabled, the administrator must specify a directory to be used by TFTP clients, and these clients cannot access other directories. Even within the TFTP directory, access is read-only. TFTP should be enabled only if necessary. Disable TFTP using the following option:
options tftpd.enable off
Hypertext Transport Protocol (HTTP) runs on TCP port 80 and is the protocol used by web browsers to access web pages. Your storage system uses HTTP to access
The SecureAdmin SSL interface accepts connections on TCP port 443. SecureAdmin manages the details of the SSL network protocol, encrypts the connection, and then passes this traffic through to the normal HTTP FilerView interface through a loopback connection. This loopback connection does not use a physical network interface. HTTP communication takes place inside your storage system, and no clear text packets are transmitted.
The HTTP protocol is not vulnerable to security attacks because it provides read-only access to documents by unauthenticated clients. Although authentication is not typically used for file access, it is frequently used for access to restricted documents or for administration purposes, such as FilerView administration. The only authentication methods defined by the HTTP protocol send credentials, such as user names and passwords, over the network without encryption. The SecureAdmin product is provided with SSL support to overcome this shortcoming.
Note
In versions of Data ONTAP earlier than 7.0, your storage system listens for new connections (by default, set to TCP port 80) even when the HTTP protocol is not licensed and FilerView is disabled. However, starting with Data ONTAP 7.0, you can stop your storage system from listening for new connections by setting the options httpd.enable and httpd.admin.enable to Off. If either of the options is set to On, your storage system will continue to listen for new connections.
There are four Kerberos ports in the /etc/services file: TCP port 88, UDP port 88, TCP port 750, and UDP port 750. These ports are used only for outbound connections from your storage system. Your storage system does not run Kerberos servers or services and does not listen on these ports.
Kerberos is used by your storage system to communicate with the Microsoft Active Directory servers for both CIFS authentication and, if configured, NFS authentication.
The Network File System (NFS) is used by UNIX clients for file access. NFS uses port 2049.
NFSv3 and NFSv2 use the portmapper service on TCP or UDP port 111. The portmapper service is consulted to get the port numbers for services used with NFSv3 or NFSv2 protocols such as mountd, statd, and nlm. NFSv4 does not require the portmapper service.
NFSv4 provides the delegation feature that enables your storage system to grant local file access to clients. To delegate, your storage system sets up a separate connection to the client and sends callbacks on it. To communicate with the client, your storage system uses one of the reserved ports (port numbers less than 1024). To initiate the connection, the client registers the callback program on a random port and informs the server about it.
With delegations enabled, NFSv4 is not firewall friendly because several other ports need to be opened up as well.
You can disable the TCP and UDP ports by setting the nfs.tcp.enable and nfs.udp.enable options to Off.
To disable NFS, use the nfs off command.
The Common Internet File Service (CIFS) is the successor to the server message block (SMB) protocol. CIFS is the primary protocol used by Windows systems for file sharing.
CIFS uses UDP ports 137 and 138, and TCP ports 139 and 445. Your storage system sends and receives data on these ports while providing CIFS service. If it is a member of an Active Directory domain, your storage system also must make outbound connections destined for DNS and Kerberos.
CIFS is required for Windows file service. You can disable CIFS using FilerView or by issuing the cifs terminate command on your storage system console.
Note
If you disable CIFS, be aware that your storage system's /etc/rc file can be set up to automatically enable CIFS again after a reboot.
The Secure Sockets Layer (SSL) protocol provides encryption and authentication of TCP connections.
When SecureAdmin is installed and configured on your storage system, it listens for SSL connections on TCP port 443. It receives secure web browser connections on this port and uses unencrypted HTTP through a loopback connection to pass the traffic to FilerView, running on TCP port 80. This loopback connection is contained within your storage system and no unencrypted data is transmitted over the network.
TCP port 443 can be disabled using FilerView or with the following command:
secureadmin disable ssl
Simple Network Management Protocol (SNMP) is an industry-standard protocol used for remote monitoring and management of network devices over UDP port 161.
SNMP is not secure because
Within the industry, devices are typically configured at the factory to use public as the default community string. The public password allows users to make queries and read values but does not allow users to invoke commands or change values. Some devices are configured at the factory to use private as the default community string, allowing users full read-write access.
There are three versions of SNMP:
SNMP is required if you want to monitor a storage system through an SNMP monitoring tool, such as DataFabric® Manager. Your storage system's SNMP implementation allows read-only access. Regardless of the community string used, the user cannot issue commands or change variables using SNMP on your storage system.
You should use the snmp.access option to restrict SNMP access to a named set of trusted hosts.
Set the snmp.enable option to Off to disable SNMP entirely.
The snmp community delete and snmp community add commands are used to change the community string to something other than the default value.
Remote shell protocol (RSH) is used for remote command execution and is the only protocol supported on your storage system. It is even less secure than TFTP and uses TCP port 514.
RSH is not secure because passwords are not required for login and commands are easy to misconfigure. If possible, RSH should be disabled by setting the rsh.enable option to off.
You should use the SSH supplied with SecureAdmin for remote command execution and login. If this is not possible, Telnet is preferred to RSH.
If RSH is the only alternative, follow these guidelines when using RSH:
Your storage system sends messages to hosts specified by the user in the /etc/syslog.conf file using the syslog protocol on UDP port 514. It does not listen on this port, nor does it act as a syslog server.
The route daemon, routed, listens on UDP port 520. It receives broadcast messages from routers or other hosts using the Routing Information Protocol (RIP). These messages are used by your storage system to update its internal routing tables to determine which network interfaces are optimal for each destination.
Your storage system never broadcasts RIP messages containing routes because Data ONTAP is not capable of acting as a router.
RIP is not secure because an attacker can easily send artificial RIP messages and cause hosts running the routed daemon (such as your storage system) to redirect network traffic to the attacker. The attacker can then receive and sift this traffic for passwords and other information and send it on to the actual destination, where the intrusion is undetected. This method can also be used as a starting point for TCP session attacks.
Because of these security issues, use static routes (those set up using the route command on your storage system) instead of using the routed daemon.
Network Data Management Protocol (NDMP) runs on TCP port 10000 and is used primarily for backup of network-attached storage (NAS) devices, such as your storage systems.
The protocol defines three authentication methods:
Your storage systems support both the TEXT and MD5 authentication methods. Most NDMP-enabled backup software uses MD5 by default.
To entirely disable the TEXT authentication method, set the ndmpd.authtype option to challenge.
To restrict NDMP commands to certain authorized backup hosts, use the ndmp.access option.
Regardless of the authentication method used, NDMP sends backup data in unencrypted format over the network, as does most other backup software. A separate network optimized for backup is a common means to increase performance while retaining data security.
To disable NDMP, set the ndmp.enable option to off.
SnapMirror and SnapVault use TCP port 10566 for data transfer. Network connections are always initiated by the destination system; that is, SnapMirror and SnapVault pull data rather than push data.
Authentication is minimal with both SnapMirror and SnapVault. To restrict inbound TCP connections on port 10566 to a list of authorized hosts or IP addresses, configure the snapmirror.access or snapvault.access option. Once a connection is established, the destination storage system communicates its host name to the source storage system, which then uses this host name to determine if a transfer is allowed. You should confirm a match between the host name and its IP address. To confirm that the host name and the IP address match, set the snapmirror.checkip.enable option to On.
To disable SnapMirror, set the snapmirror.enable option to Off. To disable SnapVault, set the snapvault.enable option to Off.
Copyright © 1994-2005, Network Appliance, Inc. All rights
reserved.
Part No. 210-01082_B0
File: appc.htm
Last updated: 08-Dec-2005 13:27:25