Subject: Re: (ngtrans) The reverse lookup issue

From: "Eric A. Hall" <[email-masked]>
Date: Wed, 10 Jul 2002 13:38:04 -0500

on 7/10/2002 1:06 PM Ted Lemon wrote:
> I don't know of _anybody_ who still uses the reverse map to do
> authentication.

Nor should they. In point of fact, the only security service that reverse
PTRs are useful for is proving that something *IS NOT* something, simply
because they did not claim to be. At that point, the only real threat to
IN-ADDR spoofing is a DoS attack, keeping otherwise legitimate hosts from
connecting to a service.

-- 
Eric A. Hall                                        http://www.ehsco.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Robert Elz <[email-masked]>
Date: Thu, 11 Jul 2002 16:03:31 +0700

Date:        Wed, 10 Jul 2002 13:06:36 -0500
    From:        Ted Lemon <[email-masked]>
    Message-ID:  <[email-masked]>

  | Despite these exceptions, we do seem to have pretty broad 
  | agreement on is that we should *recommend*, not *require*, that people set 
  | up reverse domains.

I don't think we have agreement even for that - there are plenty of people
who actually want the IP6.ARPA (and IP6.INT) - and maybe even IN-ADDR.ARPA
delegations to go away, so no-one can set up a reverse domain, even if
they want to.   That doesn't sound anything like agreement to recommend
that it be done...

I wouldn't go that far, but nor would I recommend that people set up
reverse delegations.

What I would agree with is explaining to people what they're good for,
and why they might want to do it, but stopping short of actually
recommending that it be done.   I'd also want some strong words in there
though about how the data should not be used (which would not of course
prevent anyone who felt strongly enough from going ahead ad doing it anyway).

kre

---

From: Ted Lemon <[email-masked]>
Date: Thu, 11 Jul 2002 10:05:00 -0500

> who actually want the IP6.ARPA (and IP6.INT) - and maybe even IN-ADDR.ARPA

Right, you're one of the people who doesn't agree.   Of course you don't 
think we have agreement.

---

From: "Andy W. Barclay" <[email-masked]>
Date: Thu, 11 Jul 2002 07:55:12 -0700

> prevent anyone who felt strongly enough from going ahead ad doing it anyway).

I'm assuming that your last sentence was incomplete here.
You really meant ot say that "the data should not be used for 
authentication" right?

"should not be used" is silly.

FWIW, I use the information in reverse DNS all the time. I don't 
authenticate with it, but I still find it usefull for information
purposes.

-- 
Regards,
Andy W. Barclay.        [email-masked]
fax  (781) 823-8276
Always a UNIX Evangelist (and sometimes a system and network architect)

Tell a man that there are 300 billion stars in the
universe, and he'll believe you.... Tell him that a
bench has wet paint upon it and he'll have to touch it
to be sure.

---

From: Ted Lemon <[email-masked]>
Date: Thu, 11 Jul 2002 10:31:46 -0500

> prevent anyone who felt strongly enough from going ahead ad doing it 

To be a little less opaque, let me just point out that what you are trying 
to do here is to solve problem in a standard that can't be solved in a 
standard.   There is a reason why people set up services that expect the 
forward and reverse to match.   It's a useful sanity check in some cases, 
and it's handy for logging in many cases.

They are wrong to *expect* it to work - it's an incredible hassle for me 
when I'm doing testing on a network and name service isn't working that I 
have to wait a minute for the lookup to timeout before I can log into 
another machine, and I'd bloody well like it if people wouldn't code their 
clients and servers to insist on doing the lookup without being configured 
that way.

I'd also really like it if, e.g., openssh wouldn't spew out a panicky 
message about a man-in-the-middle every time I use it to ssh into a machine 
that *has* a valid DNS setup, but that gets its IP address from DHCP and 
therefore doesn't have a consistent IP address.

So we do agree that people are abusing the DNS in ways that don't make 
sense.   A machine's IP address is not its identity, and the information 
about the machine in the DNS isn't its identity either.   What we don't 
agree on is that this means we shouldn't recommend that people set up 
reverse zones.

My worry is that you, and perhaps Dean, are arguing that PTR records should 
basically go away, and I think the reason you want them to go away is 
because you believe they are being misused, and if they aren't there they 
can't be misused.   So you're arguing that we should get rid of very useful 
functionality in order to force people to stop misusing it.

Baby.   Bathwater.   Need I say more?

---

From: Robert Elz <[email-masked]>
Date: Mon, 15 Jul 2002 12:50:31 +0900

Date:        Thu, 11 Jul 2002 07:55:12 -0700
    From:        "Andy W. Barclay" <[email-masked]>
    Message-ID:  <[email-masked]>

  | I'm assuming that your last sentence was incomplete here.
  | You really meant ot say that "the data should not be used for 
  | authentication" right?
  | 
  | "should not be used" is silly.

Yes - but what it said was "about how the data should not be used."
That is, I wasn't actually saying what it should say, just that
it should say some things about inappropriate uses.

If we ever got to agree on at least this much, then we could
start the debate about what uses are inappropriate and should be
warned against.

  | FWIW, I use the information in reverse DNS all the time. I don't 
  | authenticate with it, but I still find it usefull for information
  | purposes.

Yes, so do I, though I find I use the -n options to ping/traceroute
much more often than I omit them.   But the fact that I (or you) like
to make use of other people's work doesn't mean they should forced,
requested or even just encouraged, to provide it.

kre

---

From: Derek Atkins <[email-masked]>
Date: 15 Jul 2002 00:23:50 -0400

> requested or even just encouraged, to provide it.

I find that I use the -n options when I want to rule out a DNS
problem.  Once I'm sure that the network is up via -n, I kill
ping/traceroute/mtr and re-run without -n to see where it's actually
going.

My take on where we are now is that there is enough use to NOT
depricate reverse-resolution, but perhaps add some language in
the Security Considerations that say something to affect of:

"Using DNS Reverse Resolution for Authentication is dangerous."

> kre

-derek

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
       [email-masked]                        PGP key available

---

From: Robert Elz <[email-masked]>
Date: Mon, 15 Jul 2002 16:39:26 +0900

Date:        15 Jul 2002 00:23:50 -0400
    From:        Derek Atkins <[email-masked]>
    Message-ID:  <[email-masked]>

We have already been asked to stop this on namedroppers, it probably
really belongs on dnsop, the last message I posted before I saw that
request, but since this is still here, just one last message from me.

  | My take on where we are now is that there is enough use to NOT
  | depricate reverse-resolution,

Personally, I never wanted to actually deprecate it.   What I want to
do is get rid of the expectation that it is supposed to be done.
That is, that networks that don't bother to set up reverse delegation
stop being treated as a lower form of life which should be denied all
kinds of service.

So...

  | but perhaps add some language in
  | the Security Considerations that say something to affect of:
  | 
  | "Using DNS Reverse Resolution for Authentication is dangerous."

Of course, no-one would object to that.  But that's not enough.
Something more to the effect of

	There is no requirement to configure reverse delegations
	for assigned network numbers.   Applications should not
	refuse service to an incoming connection merely because no
	reverse delegation for the source network address exists.

is what is required.   The first sentence merely states the status
quo anyway - no-one is being forced to make a reverse delegation.
The second is really a logical consequence of deciding that the
first is OK.

kre