3 ms·
DNS is actually pretty nice for ACL [1]. Just make sure you use it with DNSSEC. Want to check if Tom has access to /web/mike? Just do a lookup on the user in q
by michaelmcmillan 6y ago
DNS is actually pretty nice for ACL [1]. Just make sure you use it with DNSSEC.
Want to check if Tom has access to /web/mike? Just do a lookup on the user in question with the reversed path you want to check.
"Can Tom read /web/mike?" => tom.mike.web.server.net
Advantages:
- Replication to multiple machines is trivial (piggybacking of DNS, after all).
- Lookups are fast. Can also be easily cached.
- All sane programming languages have built-in DNS resolution in their stdlib out-of-the-box.
- Manual override using /etc/hosts for debugging/emergency.
1. https://itk.samfundet.no/dok/ITKACL2 https://itk.samfundet.no/dok/ITKACL2
- axaxs 6y agoI love hacks for DNS, but this one feels a little bit of a stretch. The absolute lack of security is probably the biggest one. Now one can troll DNS for a user who has access to a resource.
- tiernano 6y agoDoesn't necessarily have to be public dns. Could be internal to just your servers...
- michaelmcmillan 6y agoAuthentication != Authorisation. You wouldn't use this to determine if the user really is who he says he is. But in determining what a user has access to, DNS is pretty slick. The DNS server doesn't need to be public either.