Re: DNS Names for external services
Paul Melson <[email protected]>
| Newsgroups | gmane.comp.security.firewalls.wizards |
|---|---|
| Message-ID | <[email protected]> |
On Tue, Apr 13, 2010 at 12:16 PM, Behm, Jeff <[email protected]> wrote: > Just curious, what is your opinions of the security vs. ease of use trade-offs on putting DNS entries in (vs. making people > know/use an IP address) for services you expose to the Internet. You mean the security trade-off whereby we protect ourselves from hackers that are too lazy to scan with nmap -sV but not too lazy to use scandns? It's a ridiculous corner case that's not worth accounting for. On the other hand, using DNS names instead of IP addresses for Internet-facing services makes them more easily portable. For some services it can make load balancing and failover very simple and cheap. If any of your use cases is helped by naming Internet services, then do so. It's that simple. > Just looking for opinions. There are no "right" answers ;-) Yeah, I'm going to respectfully disagree with you there. :-) PaulM