Home / server / Questions / 131027
Accepted
Dave
Asked: 2010-04-10 09:09:07 +0800 CST

Does pointing *.[int].mydomain.com to 192.168.1.[int] constitute a security threat

  • 772

For testing purposes, I've found it's really useful to point whatever.machineIP.mydomain.com to 192.168.1.machineIP : that way we can test each other's code without fidgetting with hosts files.

I'm aware that this identifies our local IP addresses to the outside world, but if someone could access the network, it'd be trivial to sniff which of the local IP addresses respond to port 80 anyway.

Is there anything I'm not seeing?

Credit for the idea: http://news.ycombinator.com/item?id=1168896

domain-name-system ip wildcard-subdomain

2 Answers

  1. Best Answer

    The less you expose to the outside world, the better. You never know when a piece of information will come useful to the potential intruder. The devil is, as usual, in the details.

    Depending on your setup, it might be fairly easy to use split-horizon dns and expose .int. only to the internal network, mitigating that risk. If you ever get a security audit, this will most certainly be rubbed in your face, this is an easy pick as it is hard to argue that this is not an unnecessary information exposure.

    Other than that, go ahead, if you did your homework properly on other fields (tight firewalls, DMZs, solid and enforceable usage policies), there should not be much harm in exposing a few RFC-1918 IPs.

    • 2

  2. I do this with our internal DNS server. We have a DNS server that only serves requests to clients inside our office, I just added a few extra zones there and told him that he's the authority for them. So various names automatically resolve to internal IPs, but they wont get resolved for anyone outside our office who can't use our internal DNS server. No need for any complicated 'split-horizon' thing.

    • 2