Subject: [DNSOP] Localhost entries in zones

From: "Antoin Verschuren" <[email-masked]>
Date: Thu, 3 Apr 2008 12:19:27 +0200

Hi,

I may have missed this, but I'd like to hear the lists opinion about
this article:
http://seclists.org/bugtraq/2008/Jan/0270.html
that states that localhost entries in zones should be discouraged.

I know that localhost entries were encouraged in RFC 1537 but that one
is obsolted by RFC 1912 which doesn't say anything anymore about
localhost entries, so no encouragement nor disencouragement.
I think that if localhost entries in zones should be discouraged, it
should come from the consensus of this WG.

Antoin Verschuren

Technical Policy Advisor
SIDN
Utrechtseweg 310
PO Box 5022
6802 EA Arnhem
The Netherlands

T +31 26 3525500
F +31 26 3525505
M +31 6 23368970
E [email-masked]
W http://www.sidn.nl/

_______________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop

---

From: Edward Lewis <[email-masked]>
Date: Thu, 3 Apr 2008 10:48:45 -0400

>that states that localhost entries in zones should be discouraged.

My problem with that doc is it says "uh, don't operate DNS servers if 
you make mistakes."  Well, I am referring to the problem of 
"localhost A 127.0.0.1" not having the trailing (FQDN) dot which 
opens the doors to problems.

Here are two rules to combat this:

1) Okay, no one forget the dot, OK?
2) Unless. you. put. dots. after. every. word. for. a. week., you. 
are. prevented. from. ever. typing. named. .

>should come from the consensus of this WG.

OTOH, I have in the past been religious about including 
localhost(dot) in both the forward and reverse zones of my servers. 
But I don't go to church anymore.  I forget why I dropped the 
practice, I mean putting in the localhost(dot), not the church thing, 
but I know I wasn't happy with it.

Thinking, thinking, no, can't recall the reason now.  Maybe with time 
and discussion I will.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

Never confuse activity with progress.  Activity pays more.
_______________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop

---

From: Edward Lewis <[email-masked]>
Date: Thu, 3 Apr 2008 10:48:45 -0400

---

From: [email-masked]
Date: Thu, 3 Apr 2008 20:47:29 +0000

still do... both 

	localhost.
	1.0.0.127.in-addr.arpa.
	::1.ip6.arpa. #

# yeah yeah... shoot me

--bill

On Thu, Apr 03, 2008 at 10:48:45AM -0400, Edward Lewis wrote:
> Thinking, thFrom [email-masked]  Thu Apr  3 13:49:02 2008
Date: Thu, 3 Apr 2008 20:47:29 +0000
From: [email-masked]
To: Edward Lewis <[email-masked]>
Cc: [email-masked]
Subject: Re: [DNSOP] Localhost entries in zones
Sender: [email-masked]

 still do... both 

	localhost.
	1.0.0.127.in-addr.arpa.
	::1.ip6.arpa. #

# yeah yeah... shoot me

--bill

On Thu, Apr 03, 2008 at 10:48:45AM -0400, Edward Lewis wrote:
> Thinking, inking, no, can't recall the reason now.  Maybe with time 
> and discussion I will.
> -- 

thinking, no, can't recall the reason now.  Maybe with time

---

From: Peter Koch <[email-masked]>
Date: Mon, 14 Apr 2008 18:48:55 +0200

> that states that localhost entries in zones should be discouraged.

if I follow this correctly, the risk is for "localhost.example.org" to enable
anyone on the same host as the victim to "steal" cookies destined for
"*.example.org".  This reminds me of what Yngve has been pointing us at repeatedly
and that is the cookie mechanism makes brave assumptions about the DNS.

> localhost entries, so no encouragement nor disencouragement.

RFC 1912 is quiet about localhost entries in random forward zones, but
different from RFC 1537 it recommends setting up a "localhost" TLD on ones
local recursive name server.  So, if memory serves, there were two schools
of thought: one saying that forward and reverse should be immediately
consistent and the other trying to rely upon the search path for
resolution of the "localhost" token.  Other alternatives include
mapping this name by other means than the DNS, likely /etc/hosts on
members of the Unix family.

> should come from the consensus of this WG.

Independent of this, the "localhost" issue might need some attention because
it is related to other work on our plate, namely mixed v4/v6 search path
issues as well as topics discussed recently: the "localhost" TLD is special
in the sense that it is actually reserved by RFC 2606 but neither delegated
nor mapped to anything in real life.  Back then there was some discussion
about recommending an A RR for this name in the public DNS.  At that time,
not all root servers responded NXDOMAIN, either.

-Peter

---

From: Peter Koch <[email-masked]>
Date: Mon, 14 Apr 2008 18:48:55 +0200

-Peter

---

From: Mark Andrews <[email-masked]>
Date: Tue, 15 Apr 2008 10:09:26 +1000

> consisteFrom [email-masked]  Mon Apr 14 18:30:27 2008
To: Peter Koch <[email-masked]>
From: Mark Andrews <[email-masked]>
Date: Tue, 15 Apr 2008 10:09:26 +1000
Cc: IETF DNSOP WG <[email-masked]>
Subject: Re: [DNSOP] Localhost entries in zones
Sender: [email-masked]

> consisnt and the other trying to rely upon the search path for

	Additionally "localhost" is the only hold over from single
	label hostnames.  Everything else got qualified, initially
	by .ARPA then by other suffixes.

	Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]
_______________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop

tent and the other trying to rely upon the search path for
> not all root servers responded NXDOMAIN, either.

	Additionally "localhost" is the only hold over from single
	label hostnames.  Everything else got qualified, initially
	by .ARPA then by other suffixes.

	Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]
_______________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop