Remediating "Hidden RPC Services" Vulnerability (Port 111) on vApp 14.5.1

Products

• CA Identity Suite

Issue/Introduction

Security scanners flag Port 111 (Portmapper/rpcbind) as a "Hidden RPC Services" vulnerability on the Virtual Appliance.

Environment

Virtual Appliance (vApp) r14.5.1 and higher.

Cause

The rpcbind service facilitates Portmapper requests required for NFS v3 storage mounts. This service exposes registered RPC programs, which security compliance policies often restrict.

Resolution

Transition storage protocol to NFS v4 to eliminate the requirement for the Portmapper service.

1. Update mount configuration in /opt/CA/VirtualAppliance/custom/mounts to include vers=4.
2. Disable NFS v2 and NFS v3 on the target NFS server.
3. Verify stability of NFS v4 mounts.
4. Stop and mask the rpcbind services to close Port 111:
   • sudo systemctl stop rpcbind.service rpcbind.socket
   • sudo systemctl disable rpcbind.service rpcbind.socket
   • sudo systemctl mask rpcbind.service rpcbind.socket
5. Confirm Port 111 is no longer listening by running rpcinfo -p localhost.