Full Disclosure mailing list archives
Re: Reverse dns
From: Simon Biles <simon.biles () gmail com>
Date: Fri, 11 Mar 2005 14:11:46 +0000
All other debates about it being required or not aside, I recently was working with someone for whom reverse DNS stopped working properly for a period. They found that although it didn't "break" some protocols, a large number of things slowed down while a reverse DNS request timed out these included ssh and ftp. Additionally some website authentication mechanisms make use of a reverse DNS lookup as part of their security, so these would be affected as well. Cheers, Si On Thu, 10 Mar 2005 16:35:49 -0500, Valdis.Kletnieks () vt edu <Valdis.Kletnieks () vt edu> wrote:
On Thu, 10 Mar 2005 11:30:51 CST, Paul Schmehl said: give details. I'll give you this much. We're having aphilosophical disagreement about the value of disallowing reverse dns for hosts on our network. It's the ancient security by obscurity discussion. My concern is that we should not disable dns when (or if) it's required. Obviously we would not disable it for the MX hosts, but I'm unclear what (if anything) the RFC requirements are. Absent any requirements, there's not cogent argument for *not* doing it, with the aforementioned exceptions.The security via obscurity is very slim - remember that if they're looking for the PTR entry, they *already* have the IP address.. One good reason to put the PTR out there is because it allows sanity-checking of your DNS - if you have 'foo.example.com A 10.10.100.1', then there should be a '1.100.10.10.in-addr.arpa PTR foo.example.com' to match. If you fumble-finger and get 'foo.example.com A 10.10.100.10', you can catch it because when you look up the PTR, you find '10.100.10.10.in-addr.arpa PTR bar.example.com'. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://www.secunia.com/
-- Simon Biles CISSP, OPSA, BS7799 Lead Auditor, MBCS _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://www.secunia.com/
Current thread:
- Re: Reverse dns, (continued)
- Re: Reverse dns Paul Schmehl (Mar 10)
- Re: Reverse dns Duo (Mar 10)
- Re: Reverse dns Paul Schmehl (Mar 10)
- Re: Reverse dns Duo (Mar 10)
- Re: Reverse dns Danny (Mar 10)
- Re: Reverse dns (whether you want it or not) TheGesus (Mar 10)
- RE: Re: Reverse dns (whether you want it or not) Edward Ray (Mar 11)
- Re: Reverse dns (whether you want it or not) Dave Korn (Mar 11)
- Re: Re: Reverse dns (whether you want it or not) Danny (Mar 11)
- Re: Reverse dns Paul Schmehl (Mar 10)
- Re: Reverse dns Valdis . Kletnieks (Mar 11)
- Re: Reverse dns Simon Biles (Mar 11)
- Re: Reverse dns Paul Schmehl (Mar 10)
- Re: Reverse dns Valdis . Kletnieks (Mar 11)