Re:Automatic SSL Certificates for internal IP's for home k8 ...
by Xylakant on Thursday September 03, 2020 @06:59AM
(#24362763)
It may be of interest for attackers that have no visibility into your network and make cross site attacks against you easier. For example, if I know that your router is available at router.network.internal, I might just try and see if your browser is logged in and send you a link to a page that starts making requests against that interface. Enumerating network resources can certainly be done via other ways, but DNS is a particularly easy one.
Re:Automatic SSL Certificates for internal IP's for home k8 ...
by cassianoleal on Thursday September 03, 2020 @08:35AM
(#24363369)
Interesting but 192.168.0.1 or 192.168.1.1 would probably cover 80% of that use case.
This is just security by obscurity. It doesn't add much if you already implement actual security in the form of firewalls, network segregation, etc.
Re:Automatic SSL Certificates for internal IP's for home k8 ...
by Xylakant on Thursday September 03, 2020 @09:00AM
(#24363582)
I agree that it's certainly not a substitute for a proper security setup, but it definitely makes an attackers life easier - up to the point where it may get interesting to automate this. So as always, it's a tradeoff. Both options may be acceptable (and I've run a setup where I'd have internal names exposed on public DNS for years), but you need to be aware of the tradeoff to make that judgement.
Re:Automatic SSL Certificates for internal IP's for home k8 ...
by iso1210 on Thursday September 03, 2020 @08:19AM
(#24363245)
I guess it could be useful for human level attacks, something like
"Hi it's Bob down in IT, any chance you could reboot 'funkyserver123', it's on 172.18.12.5, for some reason I can't get in"
Re:Automatic SSL Certificates for internal IP's for home k8 ...
by cassianoleal on Thursday September 03, 2020 @08:27AM
(#24363310)
Why would I answer a request from Bob down in IT about my home network?
Edit: I don't know why this is being downvoted. The OP is about a home k8s setup, so unless you live in some castle or palace I very much doubt there will be a Bob down in IT.
Pretty much this. What does it matter if you know certain hostnames or internal IPs on my network? It's all firewalled anyway, and if it wasn't it would be trivial to find them out on your own...