can nfs-kernel-server of Linux bind to localhost?

[Khufu]

Hello. I followed the instructions on many websites to wrap NFS4 in SSH
so that to the nfs daemon it is a local mount.

The NFS server is on a public server. Besides the option to use a
firewall, I wonder if it is possible the nfs server can be configured to
only listens to localhost, like most mysql daemon is configured to, to
enhance security.

I tried to look up manual for nfsd which says:

-H or --host hostname
specify a particular hostname (or address) that NFS requests
will be accepted on. By default, rpc.nfsd will accept NFS
requests on all known network addresses. Note that lockd (which
performs file locking services for NFS) may still accept request
on all known network addresses. This may change in future
releases of the Linux Kernel.

This almost hints -H is equal to --bind of many other daemons. I added
this to the call of nfsd in /etc/init.d/nfs-kernel-server (a debian box)
and restarted the service. Result not good:

# netstat -tl | grep nfs
tcp 0 0 *:nfs *:* LISTEN

where I expected

# netstat -tl | grep nfs
tcp 0 0 localhost:nfs *:* LISTEN

Question is how and can nfs-kernel-server of Linux bind to localhost?

[J.O. Aho]

Post by Khufu
Question is how and can nfs-kernel-server of Linux bind to localhost?

I have always set the /etc/host.allow /etc/host.deny to limit access to the
nfs service and then in /etc/export also )so if the deny/allow would fail to
work, the nfs won't be shared to machines which shouldn't have access to the
shares.

[Zhang Weiwu]

Post by Khufu
-H or --host hostname
specify a particular hostname (or address) that NFS requests
will be accepted on. By default, rpc.nfsd will accept NFS
requests on all known network addresses. Note that lockd (which
performs file locking services for NFS) may still accept request
on all known network addresses. This may change in future
releases of the Linux Kernel.
This almost hints -H is equal to --bind of many other daemons. I added
this to the call of nfsd in /etc/init.d/nfs-kernel-server (a debian box)
# netstat -tl | grep nfs
tcp 0 0 *:nfs *:* LISTEN

I discovered that both --host and --port parameter for nfsd does not
work on my server Debian 5.0.3 both both do work on my notebook
computer, Ubuntu 10.10. And when it works, --host option does exactly
what --bind works for other daemons, that is, it's not an access
control, but really a bind to the specified interface.