Subject: [dhcwg] FQDN Udate for DHCP Assigned Addresses

From: "James Kempf" <[email-masked]>
Date: Tue, 6 Dec 2005 12:48:49 -0800

Dear DHC WG members,

The MIP6 WG is currently working on a draft for dynamic assignment of home 
addresses, and we are debating how to do FQDN update. Since the situation is 
very similar to DHCP in some respects (namely, in one scenerio, the home 
agent assigns the address) we are curious what current practice is for DHCP. 
In a poll of the DNS community, we were told that Yakov wrote a draft some 
time ago suggesting that having the server do the update rather than having 
the host do it was most likely to get traction due to security issues. Has 
this, in fact, turned out to be the case? If so, I notice that 
draft-ietf-dhc-fqdn-option-11.txt contains provision for client update. Is 
it anticipated that the security issues have been solved or will be solved 
so that host update will no longer pose a security threat? The specific 
issue the MIP6 community has identified is a fully authenticatable host (i.e 
via TSIG or SIG0) that nevertheless updates its FQDN with a victim's address 
in order to launch a redirection attack.

            jak 

_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg

---

From: Ralph Droms <[email-masked]>
Date: Sun, 11 Dec 2005 19:33:45 -0500

James - the current (deployed) practice for DHCP-assigned addresses is
to have the DHCP server perform the DDNS updateds, because of the
reduction in administrative overhead resulting from providing security
between the DHCP service and the DNS service, instead of security
between the DNS service and each of the hosts using DHCP.

If the host is "fully authenticable" and there are provisions for
managing security between the DNS service and the hosts receiving
dynamically assigned addresses, it should be acceptable for the hosts to
perform the DDNS updates.

- Ralph