---
title: "Germany BSI abuse message prevention"
url: https://michalasobczak.pl/posts/germany-bsi-abuse-message-prevention.html
author: "Michał Sobczak"
description: "In case of an Abuse message from BSI (in Germany), the following services must be enabled and disabled: Verify in 2 ways: Cutting with DROP traffic by Suricata IPS is not sufficient, because not all possible traffic signatures on port 111 are used and in most cases this port…"
published: 2023-10-08T10:05:44.000Z
updated: 2024-08-29T08:21:03.000Z
language: en
categories: ["Security"]
tags: ["Debian", "Hetzner", "Proxmox"]
license: CC BY-NC-ND 4.0 (https://creativecommons.org/licenses/by-nc-nd/4.0/)
---
# Germany BSI abuse message prevention

In case of an Abuse message from BSI (in Germany), the following services must be enabled and disabled:

```bash
systemctl disable rpcbind.target
systemctl disable rpcbind.socket
systemctl disable rpcbind.service
systemctl stop rpcbind.target
systemctl stop rpcbind.socket
systemctl stop rpcbind.service
```

Verify in 2 ways:

```text
rpcinfo -T udp -p 192.168.45.67

telnet 192.168.45.67 111
```

Cutting with DROP traffic by Suricata IPS is not sufficient, because not all possible traffic signatures on port 111 are used and in most cases this port can be enumerated.