DNS access from DMZ

[mike.patterson at unb.ca (Mike Patterson)]

Paul Asadoorian wrote on 12/1/08 1:32 PM:
> > So my next idea is just to create hosts file entries in each DMZ web server.
>
> That could work, however if I compromise any system I will be able to
> see a list of all the other hosts.

Assuming your hosts file is well-maintained.  :(  Ours generally is,
but...  If you compromise any system, you could maybe just try a zone
dump.  (So don't allow that even from internal hosts, but how many do?)

You could also get the same information passively, although it'll take
longer so you're at least raising the bar.

But even if you don't know the hostnames, once you've compromised a
system on the inside, you can start to make intelligent guesses (based
on netmasks) how many others to look for.

Mike