2

For testing purposes, I've found it's really useful to point whatever.machineIP.mydomain.com to 192.168.1.machineIP : that way we can test each other's code without fidgetting with hosts files.

I'm aware that this identifies our local IP addresses to the outside world, but if someone could access the network, it'd be trivial to sniff which of the local IP addresses respond to port 80 anyway.

Is there anything I'm not seeing?

Credit for the idea: http://news.ycombinator.com/item?id=1168896

Dave
  • 220
  • 1
  • 2
  • 6

2 Answers2

2

The less you expose to the outside world, the better. You never know when a piece of information will come useful to the potential intruder. The devil is, as usual, in the details.

Depending on your setup, it might be fairly easy to use split-horizon dns and expose .int. only to the internal network, mitigating that risk. If you ever get a security audit, this will most certainly be rubbed in your face, this is an easy pick as it is hard to argue that this is not an unnecessary information exposure.

Other than that, go ahead, if you did your homework properly on other fields (tight firewalls, DMZs, solid and enforceable usage policies), there should not be much harm in exposing a few RFC-1918 IPs.

Aleksandar Ivanisevic
  • 3,377
  • 21
  • 24
  • +1 for do not leak internal information (hostnames, private IPs) to the public internet. – voretaq7 Apr 09 '10 at 17:24
  • I don't have the karma to vote you up yet, but does your answer change if I just problematically map 255 (or 2^16) domain names to 255 (or 2^16) potential local IP addresses? – Dave Apr 09 '10 at 20:05
  • Dave, depends a lot on the context, an attack is usually a combination of many misfortunes, for example; secure.int.example.com carries much more potential than 1000 domains like a0b0c0d0.int.example.com, but it might as well be reverse, depending on a context. – Aleksandar Ivanisevic Apr 11 '10 at 10:52
2

I do this with our internal DNS server. We have a DNS server that only serves requests to clients inside our office, I just added a few extra zones there and told him that he's the authority for them. So various names automatically resolve to internal IPs, but they wont get resolved for anyone outside our office who can't use our internal DNS server. No need for any complicated 'split-horizon' thing.

davr
  • 1,729
  • 3
  • 14
  • 25