News for hackers. Stuff that matters.
Re:[email protected] by Hamuko on Sunday September 27, 2020 @10:10AM (#24606723)
Can't wait for .internal to be registered so that my internal DNS breaks.
Re:[email protected] by jeroenhd on Sunday September 27, 2020 @11:09AM (#24607177)
The only proper way to do internal DNS is to register a domain. Even a free one will do.

The more people follow decent practices at home, the fewer businesses will accidentally break because on of the admins thought it'd be alright because it works for them at home. If you set your DNS domain correctly you can also save yourself some typing effort because DNS will automatically append the network name (so you can http://test instead of http://test.internal or http://test.hamu.co). As an added bonus, you can get valid TLS certificates for your internal network devices without messing with a certificate authority of your own!

Re:[email protected] by srtjstjsj on Sunday September 27, 2020 @12:30PM (#24607847)
It's terrible that the spec doesn't reserve something like .localdomain that is unregisterable so that DNS servers can use it for internal use.

.test doesn't quite cut it.

Re:[email protected] by kzrdude on Sunday September 27, 2020 @04:06PM (#24609756)
You could propose this to be implemented, surely?
Re:[email protected] by CydeWeys on Sunday September 27, 2020 @05:29PM (#24610272)
It's already being proposed by one of my colleagues. See: https://tools.ietf.org/html/draft-wkumari-dnsop-internal-00

It does seem much, much more likely that .internal will be definitely reserved for this purpose than that it will ever be delegated as an actual real TLD. If you have to pick a fake TLD to use that isn't one of the 4 mentioned in RFC 2606 that has the best chance of actually being reserved for this purpose in the future, then .internal is it.

Re:[email protected] by Hamuko on Sunday September 27, 2020 @12:15PM (#24607742)
I do have a domain but I don't want to enter my private IP addresses on a public DNS. Hence I just have server.internal to point to the correct IP address on my local DNS server and have service1.server.com, service2.server.com, etc. all just CNAME to server.internal.
Re:[email protected] by PowerBar on Sunday September 27, 2020 @12:33PM (#24607876)
You don't need to disclose anything on the public DNS. Just register the domain, then use it internally.

For example, if you buy "example.com", just set your public DNS (assuming your registrar provides one) to resolv it to 127.0.0.1, then add your internal hostnames and IP addresses to your internal DNS. If you do it that way, "my-server.example.com" will simply fail to resolve unless you're on your internal network and you don't have to worry about any issues with using the reserved *.internal domain.

Re:[email protected] by Hamuko on Sunday September 27, 2020 @12:42PM (#24607947)
I need to have the public DNS anyways so I find this way to be easier. I'd have to use CNAMEs anyways since the .internal addresses have to resolve to different IP addresses depending on the context.
Re:[email protected] by PowerBar on Saturday October 03, 2020 @06:52PM (#24675266)
Why would your A records change depending on context? Do you have separate networks where "server.localdomain" has different IPs? The typical way to solve that is to use different sub-domains for each one.

For example if you have a home network and a testing network, you could have one on home.example.com and the other at lab.example.com, in which case your servers would be server.home.example.com and server.lab.example.com. If you use DHCP on those networks, you simply set the domain and search-domain options and you can just enter "server/" on the devices that moves between them.

You only need to register example.com with a registrar, then you can use whatever subdomains you want wherever you want.

Re:[email protected] by kubanczyk on Saturday October 03, 2020 @07:34PM (#24675474)
> Why would your A records change depending on context?

Good grief, usually it's because of a hairpin nat. People do that to themselves. They damage their own L3 networking and then decide that they need to damage also their entire DNS as a workaround.

It's a regular mind virus, because it's easy to implement split-horizon DNS but enormously expensive to remove it. People get used to it on one company and go and spread it on another company.

Just do a snat+dnat. These networking boxes are so expensive because they are meant to handle it, so let them do their job already. Or go IPv6 and get rid of DNAT altogether.

Re:[email protected] by CydeWeys on Sunday September 27, 2020 @12:27PM (#24607833)
You can continue using /etc/resolv.conf to specify the private IP addresses even for a website that does actually exist. The point of registering the domain is to ensure that your computer/software can't ever accidentally hit anything you didn't intentionally configure that is actually under the control of someone else. You don't actually need to use publicly visible DNS to configure your internal network just because you used a real domain name.
Re:[email protected] by detaro on Sunday September 27, 2020 @12:59PM (#24608070)
If you have a local DNS server, you can just have the service1.yourdomain.com only resolve there. Totally standard practice.
Re:[email protected] by Hamuko on Sunday September 27, 2020 @01:08PM (#24608145)
My local DNS server can't resolve certificate verifications so I need a public DNS server anyways.
Re:[email protected] by bradstewart on Monday September 28, 2020 @10:39AM (#24617085)
> don't want to enter my private IP addresses on a public DNS

Why not?

Re:[email protected] by tialaramex on Sunday September 27, 2020 @04:40PM (#24609982)
Once upon a time plenty of people thought it'd be cool to give their "internal" stuff names like wwwtest.int and database.int and so on.

Now, there has actually been an int TLD for a long time, but you probably don't visit sites in that TLD very often because it is for international organisations like the UN.

So if your configuration blocks all those actual sites well, too bad right?

However, back that long ago the trusted Public CAs were not actually forbidden from issuing certificates for names that don't belong to anybody on the public Internet. This was a bad idea, but it was not yet (at that time) forbidden. So you could pay Thawte a pile of money and get a certificate for "exchange2" your backup MS Exchange server or maybe "linux.build" your Linux build server.

And since people were using this for internal names, you'd get people asking their CA for certificates like "exchange2.int" - for the internal backups MS Exchange server right?

Obviously there can't be any effective way to demonstrate control over internal names, since you do not in fact have control over them, you've just hijacked them.

And so the end result is that there were actual publicly trusted CAs issuing certificates for names in a real public TLD without checks, because they assumed it was internal when it was actually not.

These days the CAs are required to issue only for names in the actual Internet DNS hierarchy (plus TOR) and only after seeing one of the accepted proofs of control nicknamed the Ten Blessed Methods.

Meanwhile: There is only one namespace, do not try to hijack little pieces for yourself that don't belong to you. If you want to reserve some names so that your DNS doesn't "break" then you can buy names like anybody else.

Re:[email protected] by samoa42 on Sunday September 27, 2020 @10:20AM (#24606825)
should have used .local
Re:[email protected] by detaro on Sunday September 27, 2020 @10:32AM (#24606920)
Not really. .local is often tied to zeroconf/mDNS and doesn't work reliably over traditional DNS on all platforms.
Re:[email protected] by nitrogen on Sunday September 27, 2020 @12:51PM (#24608007)
mDNS is actually pretty nice on controlled networks, so if you want .local use mDNS.