lockd: rejected NSM callback from 7f000001:30001

lockd: rejected NSM callback from 7f000001:30001

[Haakon Riiser]

A few months ago, I upgraded my file server from FC3 to FC5,
and at the same time, upgraded all of the file server's hardware
except the disks (a single SATA drive that holds the OS plus four
SATA drives in a software RAID5 array).

After this upgrade (at least that's when I think it first started to
happen), I started seeing

  lockd: rejected NSM callback from 7f000001:30001

in dmesg.  It causes no apparent errors, but I'm still wondering
if there's something I should (or can) do about it.  The error
messages seem to pop up at random times -- often at times when the
system is completely idle, but it can be days between each time
they occur.

When the error message is printed, it's always more than one line,
but there's a few seconds (typically 4 or 6) between each message.

Current system info:

kernel-2.6.17-1.2174_FC5
glibc-2.4-8
nfs-utils-1.0.8-3

Regarding the port number above, 30001, I have fixed it to that
value by setting STATD_OUTGOING_PORT=30001 in /etc/sysconfig/nfs.
Could this be causing my problem?  Of course, I shouldn't be asking
this as I could try it out for myself, but it can take days before I
know if it changes anything, so I'll just get some feedback here
before I start experiementing. :)

-- 
 Haakon

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs

Re: lockd: rejected NSM callback from 7f000001:30001

[Trond Myklebust]

On Fri, 2006-09-01 at 15:28 +0200, Haakon Riiser wrote:
> A few months ago, I upgraded my file server from FC3 to FC5,
> and at the same time, upgraded all of the file server's hardware
> except the disks (a single SATA drive that holds the OS plus four
> SATA drives in a software RAID5 array).
> 
> After this upgrade (at least that's when I think it first started to
> happen), I started seeing
> 
>   lockd: rejected NSM callback from 7f000001:30001

This is very intentional. The kernel won't accept notifications from
unprivileged ports. If it did, then any local user would be able to
trick the kernel into thinking that some server had rebooted, by sending
the appropriate RPC message.

Change your /etc/sysconfig/nfs so that it sets a value < 1024 for
STATD_OUTGOING_PORT.

Cheers,
  Trond


-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs

Re: lockd: rejected NSM callback from 7f000001:30001

[Haakon Riiser]

[Trond Myklebust]

> On Fri, 2006-09-01 at 15:28 +0200, Haakon Riiser wrote:

>>   lockd: rejected NSM callback from 7f000001:30001

> This is very intentional. The kernel won't accept notifications
> from unprivileged ports. If it did, then any local user would
> be able to trick the kernel into thinking that some server had
> rebooted, by sending the appropriate RPC message.
> Change your /etc/sysconfig/nfs so that it sets a value < 1024
> for STATD_OUTGOING_PORT.

Strange that I didn't see this error before, and that I picked
a port number this high if the random port assignments were
below 1024.  Back when I decided to use fixed port assignments
(in a possibly misguided attempt at improving security), I tried
to pick numbers that stayed close to the random assignments.

Anyway, thanks for the quick response.  Either I'll assign a
privileged port, or I'll do away with fixed port assignments and
the associated firewall rules entirely.

-- 
 Haakon

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs