Re: [tlug] Slooooooow down: logs, smartctl, DNS? [SOLVED?]

["Stephen J. Turnbull" <stephen@example.com>]

Darren Cook writes:

 > A bit of googling on "address spoofing SSH" says it won't work; even if
 > you say you are 1.2.3.4 the server will reply to the real 1.2.3.4, not
 > to you.

True.  The potential problem is that in a dynamic DNS world, your
machine may have a reliable domainname, but not a reliable IP.  Thus
some identification mechanisms may filter on the domainname.
Roundtripping through the DNS will allow confirmation that the
domainname and IP actually do match, and that therefore the host's
address and domainname was set up by somebody with enough privilege to
manipulate DNS for that domain.  That's either a properly authorized
admin, or a very skilled cracker.

 > might work. But I still don't see how a DNS lookup changes anything: if
 > I can change the IP address on machine C I can also change the hostname.

No, you can't in the sense you mean here.  You can change the hostname
that the host knows, but you can't change its domainname (the hostname
that the DNS knows) to something you don't "own" in the DNS.  (Unless
you subvert the DNS itself, which since release of bind9 has become
much harder even without thorough implementation of DNSSEC.)

 > (I realize I must be misunderstanding something, somewhere, or sshd
 > wouldn't have the UseDns option :-)

In my experience, all these DNS roundtrip checks are much more
annoying than useful.  ISTM that even today, you're more likely to run
into a poorly configured DNS than a trivial spoofing attack that would
be caught by something like this.  But then, I don't really have that
much to protect, so perhaps the bad guys simply haven't bothered to
hit me where it hurts yet.

I found "the firewalls book" (Firewalls and Internet Security, by
Bellovin and Cheswick) to be really helpful in understanding these
issues.  I don't know if it has been revised since I bought it about
15 years ago :-), but even if not, the based principles are very
clearly explained, and they have a number of rather entertaining
stories.