5 ms·
Did all of those internal hostnames need to be accessed over the internet in the first place? I don't envy you though, that's quite a few subdomains you have t
by Namidairo 11y ago
Did all of those internal hostnames need to be accessed over the internet in the first place?
I don't envy you though, that's quite a few subdomains you have there. Although I think that quite a few/almost all of those would have been found anyway if someone were to throw their dictionary at it.
- BillinghamJ 11y agoMost of these hostnames are on 10.x IPs, so not internet addressable anyway, but we don't really want to advertise how our internal services are structured.
- Namidairo 11y agoAh, the use of public ca implied a more general use scenario in my head. As someone else mentioned, creating a PKI is probably the way to go at this point. And I suppose double check that none of them are binding interfaces they're not supposed to, if any of those have interfaces with public IPs.
- BillinghamJ 11y agoYeah, agreed. We had used it so far simply because it was convenient. I do still think it's important for StartSSL to be very clear about this to their existing customers though - it's a breaking change of sorts. And they are definitely not, but thanks. :) They're in an AWS VPC which is only internet addressable via explicitly defined servers. The default is to not provide a public IP.
- jlgaddis 11y agoIf they're on private IP addresses, per RFC, they shouldn't be listed in a public DNS zone. If they aren't listed in a public DNS zone, it's not really an issue, is it?
- kiallmacinnes 11y agoWhich RFC is that? I've never noticed this restriction in any of the DNS RFCs (and I do DNS for a living ;)) (Honestly curious, not trying to say you're wrong !)
- pfg 11y agoI'm not aware of any RFCs on the matter either. Some DNS servers do this to protect against DNS rebinding attacks, though.
- jlgaddis 11y agoRFC1918. If memory serves, it does say "should not" and not "MUST NOT" (cf. RFC2119). Thus, it's not technically a "violation" to do so but it certainly goes against the recommendations, IMO. I also "do DNS for a living" (and have been for ~20 years) but I'm sure there's still things that I don't know. This is one of those often overlooked things simply because it isn't that common and one doesn't often see any major issues because of it.
- kiallmacinnes 11y agoSo it does, I've never noticed this section before: Indirect references to such addresses should be contained within the enterprise. Prominent examples of such references are DNS Resource Records and other information referring to internal private addresses. In particular, Internet service providers should take measures to prevent such leakage.
- BillinghamJ 11y agoStill a bit of an issue. Primarily the reasoning here is that if you compromise one of our systems, we'd prefer to make it as difficult as possible to traverse across our internal network. Obviously that is mostly handled by access controls, but every little helps.