[Hipsec-rg] reverse DNS lookups of HITs

[oleg.ponomarev at hiit.fi (Oleg Ponomarev)]

Hi! On Tue, 13 Jan 2009, Andrew McGregor wrote:

>> I might have a mistaken view, but usually we only check the presence of the 
>> key in the list of authorized/known keys, so we do not need such a lookup.
>
> I think that was exactly the point... we don't need such lookups.

... for the SSH keys, when we have complete list of them in a file. This 
may be not the case for millions of host identities.

> Personally, I think there is no need for reverse lookups.

How many hosts use HIP in your network? I implemented this because I was 
irritated by [trimmed] hex sequences in the netstat output (for example). 
I prefer understandable names and also had reverse zones (locally) for 
RFC1918 addresses in another network with thousands of hosts which nobody 
could remember by heart.

I would like to grant access to the clients from example-company.com 
regardless of their current locators. If there is no forward confirmed 
reverse DNS, what should I do now?

One could use reverse DNS for the reputation purposes.

-- 
Regards, Oleg.