On 2008-11-17 22:20, Res wrote:
On Mon, 17 Nov 2008, Jefferson Ogata wrote:
On 2008-11-17 14:25, Holger Honert wrote:
Chris Thompson schrieb:
On Nov 17 2008, Res wrote:
Ack! allow-transfer should never be any
What, never? Why not?
Security issue! You really want everyone to download your zone(s)?
I couldn't care less. If the security of my systems were the least bit
dependent on keeping DNS records secret, I would kinda suck as an admin,
wouldn't I?
does your employer know this is your attitude? he/she might take a
different stand :) I know you'd no longer be working for me, if that was
your take on how things should be.
Nor would I want to, if that would mean working for someone who puts
purportedly private information in the public DNS. :^)
DNS information crosses the Internet in the clear. There is no privacy
in the DNS. Unless you are doing your zone transfers over a private
network, there is always the potential for eavesdropping. Nor is there
protection against dictionary-based enumeration. It's a directory, after
all, by design.
Hostnames are revealed in myriad other ways, as well. For example, I
hope it's not supposed to be a secret that you are working on a host
called "roswell" with internal IP address 192.168.0.150. It certainly
shouldn't help a potential attacker to know that, if you are doing
things correctly. If knowing every hostname and IP address in your
network makes it easier for someone to compromise your enterprise, you
have some tedious spadework ahead of you.
It's very simple. If you don't want to reveal information in DNS, don't
put it in public zones.
To the rest of the list: point made. I won't belabor it any further.
--
Jefferson Ogata : Internetworker, Antibozo
_______________________________________________
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
