Subject: Re: (ngtrans) The reverse lookup issue

From: Dean Anderson <[email-masked]>
Date: Fri, 12 Jul 2002 01:02:51 -0400 (EDT)

On Thu, 11 Jul 2002, Ted Lemon wrote:
> Unfortunately, I still don't understand your point.   I get lots of good 
> use out of the reverse mappings, and I really haven't seen any evidence of 
> widespread misuse of them.   Have you?   Care to elaborate?   You seem to 
> be very happy to keep repeating your basic reasons for objecting, but when 
> someone asks you to justify them, you do not do so.

Well, I think I did state a valid objection. I apologize if I wasn't
clear. I'll try to summarize the issues.  kre and I (at least) are in
agreement.  

I think your use ("handy for logging and validation") ought to be
classfied to be misuse, and therefore there is widespread misuse of
Reverse DNS for just those purposes.

Your disagreement is that your use isn't actually misuse, and that it
should be OK to use Reverse DNS for authentication or "validation", and
logging.  You have argued that when reverse and forward maps match, that
there is some kind of useful meaning to be implied from this.  I think I
have shown through several examples that, in fact, there is no meaning
that can be attached should it happen that forward and reverse match, and
therefore validation is also a misuse of Reverse DNS.  This is the crux of
the disagreement, I think.

It is a frequent misconception that reverse DNS can be used for logging,
and authentication or validation, and therefore a "widespread misuse of
Reverse DNS."

My objection then is that reverse DNS is often misused. When used
properly, reverse DNS has only cosmetic use, and thus only a minor
benefit. The misuse can result in a number of bad things happening, from
improper authentication to useless logging.  Because of the misuse, in
comparison with the minor cosmetic benefit, I think Reverse DNS should be
deprecated.

Our disagreement revolves around what is proper use and what is misuse of
reverse DNS, and maybe more specifically whether there is any significance
for the state when Reverse DNS and Forward DNS match.  If such a state is
meaningless (since as I argue, it can't be meaningful), then there is much
misuse of reverse DNS by the people who assume it has meaning when it has
no meaning.

I think there are specific harms to each of the misuses:

Logging allows useless information to be logged, obscuring or in lieu of
what little useful indentifying information that is available, and would
have been used instead, if Reverse DNS were not available, such as the IP
address.

Authentication allows persons to gain access inappropriately.  
Authentication and Validation are almost the same. Authentication seems to
mean shell access is given.

"Validation" creates a false impression of confirmed identity, and a false
feeling of comfort that might lead one into granting priveleges without
further checks.

DNSsec could mitigate some of these harms in the cases where DNSsec is
used, but not all of the harms. In the cases where DNSsec isn't used, all
of these harms could apply to these misuses.

I don't think you dispute the harms so much as you simply dismiss them as
unimportant. This attitude towards them, I think, is probably also a harm,
since it causes people not to give proper attention to issues such as
logging and the assumptions made due to a "comfort level" obtained when
Reverse and Forward DNS match.  I think it was a similar attitude or
perhaps a false sense of comfort that led to significant security problems
in the r-commands.

These is probably not a complete list of harms.  But I think it is
sufficient, when stacked against the cosmetic benefit, to warrant serious
consideration of removing Reverse DNS from IPv6.

		--Dean

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Ólafur Gudmundsson/DNSEXT co-chair <[email-masked]>
Date: Fri, 12 Jul 2002 11:46:03 -0400

>Reverse DNS for just those purposes.

This discussion has no relevance to the DNS protocol, this is a
philosophy discussion.
Please DO NOT post any more messages to namedroppers on this subject.

         Olafur DNSEXT co-chair.