3

I am pondering using port 249 for NFS RDMA in RHEL 8.8, using the NFS export secure option requiring the port be below 1024.

https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt

The IANA list of port numbers identifies it (249-255) as related or reserved with bhfhs of port 248 with Jon Postel.

Can someone provide details on what bhfhs is, and would using port 249 pose any problems today or in the future?

Is this bhfhs related to remnants from the early days of the internet?

1
  • As mentioned by LjmDullaart, secure has nothing to do with what port the NFS server uses. secure requires the clients to use a privileged port as the source port when contacting the server, regardless of the destination (server) port. By default, Linux clients use a <1024 source port talking to a server on port 2049. The exception is clients in userspace or VMs (mapped to >1024 by the host), which is what secure aims to block. Changing the server port to <1024 does not have any tangible effect on security (server has all the data anyway).
    – TooTea
    Commented Jun 28, 2023 at 7:36

2 Answers 2

7

Port 248 is registered by John Kelly from Bell & Howell for bhfs. Normally, you should contact him before using the port he registered. However, the e-mail is no longer valid and it is impossible to track him down. Also, there are no known implementations of bhfs. As I understood, it was linked to some sort of micro fiches file system from Bell and Howell, but my memory fails me in the details and might even be wrong.

The ports 249-255 are reserved by Jon Postel, the father of the Internet. He died October 1998, so he won't be using these ports anymore. See rfc2468.

The problem with using unregistered ports is, that someone else may have the same idea about using that port. That means, that in some (exceptional, I admit) circumstances you might get a port conflict.

If it is just a configuration on servers that you manage, you should not have any problems using port 249.

RedHat says about the "secure" option:

The secure option is the server-side export option used to restrict exports to “reserved” ports. By default, the server allows client communication only from “reserved” ports (ports numbered less than 1024), because traditionally clients have only allowed “trusted” code (such as in-kernel NFS clients) to use those ports. However, on many networks it is not difficult for anyone to become root on some client, so it is rarely safe for the server to assume that communication from a reserved port is privileged. Therefore the restriction to reserved ports is of limited value; it is better to rely on Kerberos, firewalls, and restriction of exports to particular clients.

Note that is the from port, not the port RDMA listens to.

1
4

Ports 249–255 are reserved, yes, but that has nothing to do with bhfhs. I can see how the presentation suggests that there might be a relationship, but there isn’t; look for other “Reserved” entries and you’ll see that they all follow the same pattern.

Using port 249 won’t cause problems today or in future; since the ports are reserved, it’s unlikely the IANA will allocate them for “official” use by another service.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .