Processes And Ports - HP -UX B6941-90001 Administrator's Reference Manual

An Overview of ITO Processes
Secure Networking
or RPCD always runs on UDP 135, a reserved port which must be
accessible even through a firewall. Once it has the port number of the
RPC server, the RPC client can initiate the RPC call.

Processes and Ports

In addition to the checks and controls that a DCE environment supplies
for authentication and data integrity both prior to and during
connections between processes, ITO allows you to combat security
breaches more effectively by restricting to a specific range which you
define in the GUI the port numbers that processes may use. ITO then
assigns these port numbers dynamically to the processes that are
granted an RPC connection. The port numbers are configurable and are
checked against the defined range each time an RPC server registers
itself or an RPC client requests a connection.
If a service request for a port number within the range specified in the
GUI is refused because none is available, the process starts anyway and
ITO assigns a port number outside the permitted range. However, a
possible consequence of this is that the newly assigned port may not be
available either. In this case, ITO generates an error message. For more
information on how to set port ranges and the consequences of incorrect
port assignment, see the HP ITO Administrator's Guide to Online
Information.
Dynamic Port Assignment through a Firewall:
Example Scenario
If the security precautions of a given environment require that a
restriction be applied to the nodes, ports or protocols that are allowed to
pass a packet-filtering firewall, the administrator might configure the
firewall to enable, for example, the port range 1050 to 1300 on the
managed nodes and ports 1200 to 1500 on the server for ITO traffic. The
administrator does this by "switching off " all port numbers not in the
specified range to traffic in the direction specified. The only exception to
this is port 135 which is used for access to the RPCD/LLBD and must not
be blocked. All ITO-specific traffic then has to go through the designated
ports. The scenario described below would be the consequence of such a
configuration:
The Control Agent on a managed node registers TCP/UDP port 1050
in its unique RPCD/LLBD and listens there for ITO traffic.
370 Chapter 9