Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Date: Tue, 1 Mar 2016 13:44:54 +0100 (CET)
From: fabien@apache.org
To: APACHE development mailing list <dev@httpd.apache.org>
Subject: Re: access control for dynamic hosts
In-Reply-To: <56D417E2.3030408@thelounge.net>
Message-ID: <alpine.DEB.2.10.1603011337370.18133@sto>
References: <alpine.DEB.2.10.1512200931040.29581@sto>
 <CAA=k7mUMDyTNdfagxsejQM49DF8jh5rw+CmDy3_4fJ3MY0sgCQ@mail.gmail.com>
 <alpine.DEB.2.10.1601142224300.1035@sto>
 <CAA=k7mUcBTXkMsk99P1akQBkR_ayFwScP1PQzQDZwknPHDS4rw@mail.gmail.com>
 <alpine.DEB.2.10.1602290712290.11546@sto>
 <56D417E2.3030408@thelounge.net>
User-Agent: Alpine 2.10 (DEB 1266 2009-07-14)
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; format=flowed; charset=US-ASCII


>> This feature makes sense because it allows to allow a full domain, say
>> "apache.org", any host of which the inverse dns resolves to the domain
>> can then be allowed.
>> 
>> But this also means that if the reverse dns is not controlled, say with
>> the dynamic dns and a moving ip, ip control does not work, hence my
>> proposal for a lesser version which just checks that a client ip is
>> allowed just by resolving a name.
>
> that is unsafe

> it takes me exactly 5 seconds to add a PTR "myserver.apache.org" to one of 
> our public ip-addresses if i would like to and nobody can do anything against 
> it except check if the A record matchs because that can only be controlled by 
> the domain owner

Indeed, but then "host" also checks that forward resolution works, that is 
"myserver.apache.org" must *also* point back to the same IP.

> the same for anybody else who has a /24 or bigger network and the reverse dns 
> delegated to his own namservers - i would not do such things, others would 
> and so it's nothing to hand authentication on it

Sure, the second forward checks that all is well.


The feature I'm proposing is not related to that. I'm suggesting to have a 
way to specify host names *only* which are checked forward *only*.

   Require xxx foo.apache.org
   # allows ip of "foo.apache.org", just be resolving the name

For use with dyndns services.

-- 
Fabien.