银河麒麟高级服务器操作系统V10 使能NFS支持tcp-wrappers（hosts.deny）解决“CVE-1999-0554”问题

下载源码包

wget https://mirrors.huaweicloud.com/openeuler/openEuler-20.03-LTS-SP3/source/Packages/nfs-utils-2.5.1-4.oe1.src.rpm

安装源码包

rpm -ivh nfs-utils-2.5.1-4.oe1.src.rpm

修改spec文件

vi rpmbuild/SPECS/nfs-utils.spec

名字重新定义

软件包名称为：compat-nfs-utils

Package名称（Pname）为：nfs-utils

修改编译用的“%{name}”改为“%{Pname}”

检查、修改Requires信息

“    --without-tcp-wrappers \”改为“    --with-tcp-wrappers \”

修改“BuildRequires”，增加“BuildRequires: tcp_wrappers-devel”

修改“Requires”，增加“Requires:   tcp_wrappers”

修改spec文件名称

mv rpmbuild/SPECS/nfs-utils.spec rpmbuild/SPECS/compat-nfs-utils.spec

安装rpm-build工具

yum install rpm-build -y

安装依赖

yum install autoconf automake device-mapper-devel krb5-devel libcap-devel libevent-devel libtirpc-devel  libtool openldap-devel  python3-devel rpcgen sqlite-devel  tcp_wrappers-devel -y

打包

rpmbuild -bb rpmbuild/SPECS/compat-nfs-utils.spec

安装软件包

yum install gssproxy quota rpcbind -y

rpm -ivh rpmbuild/RPMS/aarch64/compat-nfs-utils-2.5.1-4.ky10.aarch64.rpm rpmbuild/RPMS/aarch64/compat-nfs-utils-help-2.5.1-4.ky10.aarch64.rpm

配置NFS测试

systemctl start nfs

cat > /etc/exports << EOF

/root *(rw,sync,no_root_squash)

EOF

exportfs -r

showmount -e 127.0.0.1

测试hosts.deny

配置

cat > /etc/hosts.deny << EOF

portmap:ALL

lockd:ALL

mountd:ALL

rquotad:ALL

statd:ALL

showmount:ALL

EOF

systemctl restart nfs

测试

另外一台设备（192.168.137.1）

showmount -e 192.168.137.102

配置hosts.allow

配置

cat > /etc/hosts.allow <<EOF

portmap:192.168.137.1

lockd:192.168.137.1

rquotad:192.168.137.1

mountd:192.168.137.1

statd:192.168.137.1

EOF

测试

另一台设备（192.168.137.1）