Portmapper service (RPCbind service) is a network service responsible for mapping RPC (Remote Procedure Call) program numbers to the IP addresses and transport protocol ports of the servers. This service is often used by clients in locating network services and by servers to advertise the availability of their services. It is typically used in conjunction with other RPC-based services, such as NFS (Network File System) and NIS (Network Information Service) and it runs on TCP and UDP port 111.

If Portmapper service is not secure and properly configured it can pose a security risk. Below are some of the potential security issues associated with the Portmapper service:

• Information disclosure: The Portmapper service can be used by an attacker to gather information regarding network services on a system. This information can then be used to plan for an attack.
• Unauthorized access: Without proper protection, this service can be accessed by unauthorized users who can then connect to other network services running on the system.
• Amplification attacks: The RPCbind service is vulnerable to amplification attack. An attacker can use a spoofed IP address to send a request to the Portmapper service, causing it to respond to the spoofed IP address with a large amount of data, potentially causing a denial of service.
• Unpatched vulnerability: Depending on the version there can be unpatched vulnerabilities present in the portmapper service which can be exploited by an attacker to gain unauthorized system access.

If you’re using Portmapper service in a production environment ensure it is well configured and protected to mitigate the risks associated with it. Some of the security measures will include:

• Ensuring the system and services are up-to-date with the latest security patches
• Configuration of the firewall rules to limit access to Portmapper service
• Disabling the service if not required or used in your network

Checking RPC services on the system

The RPC information report can be checked using rpcinfo command on the system. The command will return a list of all the registered RPC services with rpcbind on host.

To display all registered RPC services on the system run the commands below:

$ rpcinfo -p
   program vers proto   port  service
    100000    4   tcp    111  portmapper
    100000    3   tcp    111  portmapper
    100000    2   tcp    111  portmapper
    100000    4   udp    111  portmapper
    100000    3   udp    111  portmapper
    100000    2   udp    111  portmapper

In the output you’ll get program numbers, versions, and protocol types. If host is not specified, the local host is the default.

If you want the information on a specific host, use the syntax rpcinfo -p [hostname], see example below:

$ rpcinfo -p 172.20.30.6
   program vers proto   port  service
    100000    4   tcp    111  portmapper
    100000    3   tcp    111  portmapper
    100000    2   tcp    111  portmapper
    100000    4   udp    111  portmapper
    100000    3   udp    111  portmapper
    100000    2   udp    111  portmapper

To send a ping request to the specified RPC service on the specified host and display the response, use:

rpcinfo -u [hostname] [program_number] [version_number]

Example:

$ rpcinfo -u 172.20.30.6 100000 4
program 100000 version 4 ready and waiting

Disable Portmapper service / RPCbind on Linux

It is good to mention that disabling or removing the Portmapper service may cause issues with other network services that depend on it for their functionality. Before you make the change, ensure you understand the implications of disabling it and that no services require it in the system.

If Portmapper service is not required on your system it can be disabled. But first check if rpcbind service is running:

$ systemctl status rpcbind
● rpcbind.service - RPC Bind
   Loaded: loaded (/usr/lib/systemd/system/rpcbind.service; enabled; vendor preset: enabled)
   Active: active (running) since Thu 2025-01-25 16:48:18 EAT; 1 months 24 days ago
     Docs: man:rpcbind(8)
 Main PID: 987 (rpcbind)
    Tasks: 1 (limit: 407716)
   Memory: 1.8M
   CGroup: /system.slice/rpcbind.service
           └─987 /usr/bin/rpcbind -w -f

Jan 25 15:48:18 ubuntu-noble.cloudspinx.com systemd[1]: Starting RPC Bind...
Jan 25 15:48:18 ubuntu-noble.cloudspinx.com systemd[1]: Started RPC Bind.

If it’s in running state we can stop it.

sudo systemctl stop rpcbind rpcbind.socket

Also disable the service from starting automatically at boot time by running the following command in your terminal.

sudo systemctl disable rpcbind rpcbind.socket

Try executing rpcinfo to confirm the service is stopped.

$ rpcinfo
rpcinfo: can't contact rpcbind: RPC: Remote system error - Connection refused

Conclusion

As a System Administrator, it is highly recommended that you perform proper security of the Portmapper service to prevent any attacks on the system. If the service is not needed we highly recommend you disable it completely. We hope the information shared in this article was helpful to you.

More articles:

• Troubleshoot SELinux issues with SETroubleShoot and audit2allow