OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: reject_unknown_reverse_client_hostname safe?

From: Vincent Lefevre (vincentvinc17.net)
Date: Tue May 07 2013 - 18:02:43 CDT


On 2013-05-07 15:38:44 -0500, Stan Hoeppner wrote:
> On 5/7/2013 7:02 AM, Vincent Lefevre wrote:
> > And it seems that
> > some users forget to set up a PTR for all their IPv6 addresses.
> > This apparently includes Debian's mailing-list server.

I've reported a Debian bug, and one developer claimed it was "fixed".
But...

> Seems to have IPv6 rDNS:
>
> ~$ host bendel.debian.org
> bendel.debian.org has address 82.195.75.100
> bendel.debian.org has IPv6 address 2001:41b8:202:deb:216:36ff:fe40:4002
>
> ~$ host 2001:41b8:202:deb:216:36ff:fe40:4002
> 2.0.0.4.0.4.e.f.f.f.6.3.6.1.2.0.b.e.d.0.2.0.2.0.8.b.1.4.1.0.0.2.ip6.arpa
> domain name pointer bendel.debian.org.

This is confirmed by my mail archive, *except* for one mail,
where the IP address was:

2001:41b8:202:deb:216:38ff:fe0e:1ca7

Let's see the difference:

2001:41b8:202:deb:216:36ff:fe40:4002
2001:41b8:202:deb:216:38ff:fe0e:1ca7
                      ^^ ^^ ^^^^

I suspect that they temporarily changed the Ethernet card without
updating their DNS config, as only the last 6 bytes of the IPv6
address changed for this particular mail.

I fear that they could do the same mistake in the future...

--
Vincent Lefèvre <vincentvinc17.net> - Web: <http://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <http://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)