NIM 在防火墙环境中需开放的端口
NIM 端口说明（IBM 官方）
参考网站：https://www.ibm.com/support/pages/nim-communication-within-firewall-environment
Master (NIM Server)
Client (NIM Client)
Breakdown of ports that need to be opened in a firewall for use with NIM:nimsh 3901 - 3902icmp 5813
rsh* 513 - 1023**
rlogin* 513
shell* 514
bootp 67 - 68
tftp 69 and 32,768 - 65,535
nfs 2049
mountd 32,768 - 65,535 or user's choice
portmapper 111NIM 1058 - 1059
Directions for communications over ports to be opened for NIM use, if you do not want to open all necessary ports bi-directionally:BOOTP
Client UDP 68 --> Master UDP 67
Master UDP 67 --> Client UDP 68
So the client communicates from UDP port 68 to master's UDP port 67.
Then the master's UDP port 67 responds to the client's UDP port 68.
TFTP
Client UDP <--> Master UDP 69
Client UDP <--> Master UDP (random port between 32768 and 65535)
Here the client communicates via UDP to the master's port 69. The port that the client uses cannot be predicted.
Then, the master responds from port 69 back to the same port that made the request.
I used the bidirectional arrow to represent this.
Then random UDP ports are chosen on both the master and the client to affect the transfer of data. Again bidirectional.NFS
Client UDP <--> Master UDP 111
Client TCP <--> Master TCP (random port between 32768 and 65535, or the port specified in /etc/services for 'mountd' and 'lockd', as 'statd' must use the port range between 32768 and 65535)
Client TCP <--> Master TCP 2049
Similar "statements" for NFS's portmapper, mountd, and nfsd processes.ICMP
Client UDP 5813 <--> Master UDP 5813
Client TCP 5813 <--> Master TCP 5813
NIM
Client TCP <--> Master TCP 1058/1059 + 513-1023
For rsh operations, which do not occur during install
Master TCP <--> Client TCP 513, 514 + 513-1023
Firewall Considerations
NIMSH: Client TCP 1023 - 513 < --> Master TCP 1023 - 513 (For 'niminit' from the client only) Client TCP 3901 <--> Master TCP 1023 - 513 Client TCP 3902 <--> Master TCP 1023 - 513
NIM makes use of several protocols which are generally considered "risky" services on firewall machines. It is recommended that users who desire firewall protection within their NIM environment follow a few rules:
1. The NFS program usually runs at port 2049 which is outside of the privileged port space. Normally, access to portmapper (port 111) is needed to find which port this service runs on, but since most installations run NFS on this port, hackers can bypass NFS and try this port directly. NFS was designed as a LAN service and contains numerous security vulnerabilities when used over the Internet. NFS services should not be run on firewall machines. If a NIM master resides on a firewall machine, then resources should reside on another client - clients may also be used as resource servers in a NIM environment.2. If possible, TFTP servers should not be placed on firewall machines since no authentication is needed when requesting service. The TFTP protocol does allow for denying access based on entries contained in /etc/tftpaccess.ctl. NIM manages access to files in /tftpboot only; so all other directory locations should be off limits. When managed properly, TFTP access can be viewed as acceptable in the NIM environment.
3. Since rsh is the standard method of client control, clients participating in the NIM environment must allow shell service (514) or enable Kerberos in the NIM environment per client. In order to reduce the amount of open ports in the NIM environment, the following rules may be applied:
* For every NIM communication, leave five (5) ports open starting at 1023 and descending from there. So when using 'rsh' as the communication protocol and a client is communicating with the NIM master ports (1023-1019) should be left open for both the master and client. This is an estimate and may not work in all environments since other services may call rreservport() prior to, or during, NIM operations.* Users may also add secondary interfaces for each client participating in the NIM environment. The additional interfaces should be packet filtered.
* When NIM clients no longer participate in the NIM environment, or are temporarily removed from the NIM environment, users should disable rsh services on client machines by removing /.rhosts and/or removing rshd service.
需在防火墙中开放的 NIM 端口（中文整理）
需要在防火墙中打开NIM端口的主机：
Master (NIM Server)：
Client (NIM Client)：
需要在防火墙中打开以用于 NIM 的端口：
NIM：1058 至 1059 (TCP)
NIMSH：3901 至 3902 (TCP)
说明：
与rsh协议类似，NIMSH使用端口3901（stdin/stdout）和3902(stderr)
ICMP：5813 (UDP/TCP)
说明：
NIM client首次初始化时会用ICMP协议（ping）探测NIM server是否可访问
rsh & rlogin & shell：513 至 1023 (TCP)
说明：
stdin/stdout: NIM server使用’rsh’协议向NIM client发送命令，rsh需要端口 1023-513（倒序），rsh 守护进程会监听1023端口，如果1023被占用，守护进程依次选择1022，1021，直到能找到可用端口。如果直到513依然找不到可用端口，rsh守护进程启动失败。
stderr: 除了前面用于stdin/stdout的端口，stderr也会占用一个端口，一般是前面端口-1，例如前面用了1023，stderr则用1022通信。
Bootp：67 至 68 (UDP/TCP)
说明：
'BOOTP client’使用端口68 (UDP/TCP)
'BOOTP server’使用端口67 (TCP/UDP)
tftp & mountd：69 （UDP） 和 32768 至 65535 (UDP/TCP)
说明：
NIM client访问NIM server端口69 (UDP)
NIM client和NIM server都采用各自随机生成的端口进行互联通信，用以传输tftp文件随机端口介于32,768 - 65,535之间
Nfs：2049 (UDP/TCP)
说明：
NIM server要用NFS将资源export给NIM client。NFS v2和v3 使用2049端口（UDP），111（TCP），以及mountd, lockd, and statd使用的32,768 - 65,535之间的随机端口。其中大部分端口都可以人为指定，通过更改/etc/services文件，可以将某个服务固定在特定端口：
Portmapper：111 （udp/tcp）
说明：
如果使用NFSv4，需要防火墙打开portmap (111 udp/tcp)