From owner-freebsd-security Mon Nov 22 10:22: 8 1999 Delivered-To: freebsd-security@freebsd.org Received: from fledge.watson.org (fledge.watson.org [204.156.12.50]) by hub.freebsd.org (Postfix) with ESMTP id 43C1114BCC for ; Mon, 22 Nov 1999 10:21:50 -0800 (PST) (envelope-from robert@cyrus.watson.org) Received: from fledge.watson.org (robert@fledge.pr.watson.org [192.0.2.3]) by fledge.watson.org (8.9.3/8.9.3) with SMTP id NAA30289; Mon, 22 Nov 1999 13:21:10 -0500 (EST) (envelope-from robert@cyrus.watson.org) Date: Mon, 22 Nov 1999 13:21:10 -0500 (EST) From: Robert Watson X-Sender: robert@fledge.watson.org Reply-To: Robert Watson To: Niels Provos Cc: Dug Song , Tomaz Borstnar , freebsd-security@freebsd.org Subject: Re: OpenSSH & AllowHosts In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Mon, 22 Nov 1999, Niels Provos wrote: > On Mon, 22 Nov 1999, Robert Watson wrote: > > regularly connect to. I found that the new OpenSSH ignores the > > hostname-based entries and adds new IP-based entries automatically, with > > minimal warning. Is it doing all lookups based on IP and adding the key > It does not ignore them. It does additional checking with the IP address. > You can disable this behaviour by setting CheckHostIP = no in your config > file. > > > asking for confirmation, even though host keys are already present with a > > by-name lookup, I'm not sure I like the behavior--names are more likely to > > remain consistent in the world of NATs, dynamic IPs with DNS update, etc. > IP address are only added if the host key associated with the domain name > matches. Did you actually encounter any problems with this? Yes, there This is what I wanted to know--that is, that existing host keys were being used. Limited use of dynamic IPs with DNS update is something that may end in the near-term future, and is something that probably should not be relied on. For example, my boxes off of a DSL line in my home currently have static IPs, but Bell Atlantic will be moving to PPPoE and dynamic IPs in the not-so-distant future. It's also not clear to my that IP checking improves security--instead it could cause bogus errors in the presence of dynamic update or changing IPs. Robert N M Watson robert@fledge.watson.org http://www.watson.org/~robert/ PGP key fingerprint: AF B5 5F FF A6 4A 79 37 ED 5F 55 E9 58 04 6A B1 TIS Labs at Network Associates, Safeport Network Services To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message