News for hackers. Stuff that matters.

A comment on SSH hacks – a little sanity for remote workers. Parent comment

Re:SSH hacks – a little sanity for remote workers by MaxBarraclough on Thursday April 30, 2020 @04:59AM (#23028872)
Interesting that they permit TCP port 53, rather than just UDP port 53.
[ Parent | on HN ]
Re:SSH hacks – a little sanity for remote workers by kubanczyk on Thursday April 30, 2020 @05:23AM (#23028994)
RFC7766 "Recursive server (or forwarder) implementations MUST support TCP so that they do not prevent large responses from a TCP-capable server from reaching its TCP-capable clients."

large responses == some DNSSEC, some IPv6

[ Parent | on HN ]
Re:SSH hacks – a little sanity for remote workers by Piskvorrr on Thursday April 30, 2020 @05:19AM (#23028975)
My guess is that it stems from lax firewall defaults. "Allow port 53 - [tcp/udp/BOTH]?" (Yeah, I know that DNS can also work over 53/tcp, but it's rare compared to the 53/udp volume)
[ Parent | on HN ]
Re:SSH hacks – a little sanity for remote workers by acdha on Thursday April 30, 2020 @02:41PM (#23034470)
It's not as rare as it used to be a couple decades ago. If you block tcp/53 you will find a surprising number of things breaking as record sizes have increased over the years.
[ Parent | on HN ]
Re:SSH hacks – a little sanity for remote workers by mercora on Thursday April 30, 2020 @07:13AM (#23029630)
i think that is fine actually. however, if i would implement such thing i would probably redirect DNS traffic to my DNS server as long as you are not authenticated :)
[ Parent | on HN ]