[dhcwg] draft-aboba-dhc-domsearch-08.txt

The IESG discussed this document a while back, and has the following
comments:

1) The abstract and introduction talks about name services and refers
to RFC 2937 which specifies things like NIS/YP etc.

Is the intent that the domain search list apply to all name services or
just to the DNS? [I wouldn't be surprised if implementaions just apply
it to the DNS when it is configured manually in e.g. /etc/resolv.conf]

Please make the document clear on this point.

2) The security recommendation for avoiding hijack seems to seems to
   be equivalent to saying don't use the option if you want to be
   secure:

> 5.  Security Considerations
>
> Potential attacks on DHCP are discussed in section 7 of the DHCP
> protocol specification [2], as well as in the DHCP authentication
> specification [4]. In particular, using the domain search option, a
> rogue DHCP server might be able to redirect traffic to another site.
>
> To avert this attack, where DNS parameters such as the domain searchlist
> have been manually configured, these parameters SHOULD NOT be overridden
> by DHCP.

If I am open to receiving the option, I'll take a searchlist that
sends my mail for humanresources.myorg.com to
humanresources.rogue.com. 

Recommendation: what about making implementation of DHCP
authentication option a requirement for full compliance with this
spec. Sites then at least have the option of enabling it. Not clear
how one would otherwise be able to protect against the attack. At very
least, point out that the authentication option is needed to prevent
this kind of attack.

Might also be useful to mention 1535, since it discusses a similar issue.

>               A Security Problem and Proposed Correction
>                    With Widely Deployed DNS Software

Thomas

_______________________________________________
dhcwg mailing list
dhcwg@ietf.org
https://www1.ietf.org/mailman/listinfo/dhcwg