Subject: Re: (ngtrans) The reverse lookup issue

From: Greg Hudson <[email-masked]>
Date: 12 Jul 2002 10:17:16 -0400

On Fri, 2002-07-12 at 01:02, Dean Anderson wrote:
> Your disagreement is that your use isn't actually misuse, and that it
> should be OK to use Reverse DNS for authentication or "validation", and
> logging.  You have argued that when reverse and forward maps match, that
> there is some kind of useful meaning to be implied from this.  I think I
> have shown through several examples that, in fact, there is no meaning
> that can be attached should it happen that forward and reverse match, and
> therefore validation is also a misuse of Reverse DNS.  This is the crux of
> the disagreement, I think.

Of course there is meaning.  It means "this domain is listed in the DNS
as the name for this address, and it is not a complete forgery (although
it might be meaningless)."  A fine thing to log.  Log the IP address
too, since as you pointed out, the name might go away.

I wouldn't call this logging a purely aesthetic benefit.  You can use
that information to collect statistical data ("look, 30% of our
connections are from IBM") as long as you're willing to accept that
organizations can hide themselves from that collection (don't expect to
find out that another 30% of your connections are coming from the NSA).

> It is a frequent misconception that reverse DNS can be used for logging,
> and authentication or validation, and therefore a "widespread misuse of
> Reverse DNS."

There are historical examples of use for authentication (I'm still
unsure what you mean by "validation"), but I'm not aware of any recent
examples.  I think your "widespread misuse" is pretty much limited to
the occasional logging of domain names without also logging IP
addresses.

With forward DNSSEC, of course, it's fine to use reverse DNS for
authentication, as long as you don't want to give anyone negative access
rights (and aren't worried about IP spoofing, for whatever reason).  If
I want to say "only these hosts can log in here," reverse DNS works as a
hint.  An inline statement in the protocol would work just as well, if
the protocol allows for that; I'm not saying that this is a great idea,
just that it works.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Ted Lemon <[email-masked]>
Date: Fri, 12 Jul 2002 10:14:08 -0500

No, no, this is precisely the point, Dean.   You stated two objections, and 
when people pointed out the problems with your objections, you stated them 
again, without addressing the problems that were raised.   Just now you 
restated them once more, again without addressing those problems.

I am tempted to once more restate my arguments about your objections, but 
it seems pointless - we could go around like this forever.   This is why 
working groups are only required to reach "rough" consensus - sometimes 
there will be someone who, perhaps rightly, but as a minority, simply will 
not budge from their firmly held opinion that what is being proposed is 
wrong, and shouldn't happen.   So we blunder forward and see what happens.