@(#) BLURB 1.5 96/07/06 23:09:45

This is the fifth replacement portmapper release.

There is an increasing interest in access control for the NIS, mount
and other RPC-based services that are normally registered with the
portmap process. Possible attacks on RPC daemons involve:

    - theft of NIS (YP) password files

    - ypset to force hosts to bind to a rogue NIS (YP) server

    - theft of NFS file handles

My contribution is a replacement portmap program, derived from source
code in the RPCSRC 4.0 and the TIRPC source distributions.  Access
control (optional) is in the style of my tcp wrapper (log_tcp) package.

Supported platforms: this program is known to work with all SunOS 4.x
releases. With some Makefile editing it should also work on Ultrix 4.x,
HP-UX 9.x, AIX 3.x and AIX 4.x, and Digital UNIX (OSF/1).

Solaris 2.x and other System V.4 UNIXes should use use my rpcbind
replacement (ftp.win.tue.nl:/pub/security/rpcbind_*.tar.Z).

This portmap version attempts to close all portmap security problems
that are known to me.  The README file gives a complete list of
security features.

Without the availability of portmap source, possible alternatives are
1) packet filtering with a smart router (which we do anyway); 2)
linking the portmap executable against the securelib shared library.
Linking RPC daemons against the securelib library is a good idea,
anyway.

The source is available for anonymous FTP from ftp.win.tue.nl directory
/pub/security/portmap_*.tar.gz.

	Wietse Venema (wietse@wzv.win.tue.nl)
	Mathematics and Computing Science
	Eindhoven University of Technology
	The Netherlands