Re: DNS Names for external services

On Tue, 2010-04-13 at 17:30 -0400, Bruce B. Platt wrote:
> I agree. I also support using non eponymous names.  Rather than
> vpnserver.company.com, something like bart.company.com can be remembered,
> but does not immediately tell anyone what the machine might do.  So a little
> obscurity may help.
> 
> Or, make the server as impregnable as possible first, Then give it a name
> people can remember, then watch to see if people try to bust in or
> compromise it.


Or, use "bart" for your legitimate VPN, and point "vpn" to a honeypot
that screams loudly when tickled. That way you are actually deriving a
benefit from it rather than just obscurity. Likewise, if you don't run
an FTP server (or CVS, or POP3, or...), setup DNS records for those
pointing to your honeypot. Use it to respond in anyway you see fit for
defense of your network (blocking the IP, etc).

Regards,
Frank





-- 
It is said that the Internet is a public utility. As such, it is best
compared to a sewer. A big, fat pipe with a bunch of crap sloshing
against your ports.

_______________________________________________
firewall-wizards mailing list
[email protected]
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (FreeBSD)

iQIVAwUAS8nYxzHAOJeJnj8BAQK2Ww/9GDJ9oTyxJ5TPLsAgHKEFZgEU9WYb9hkS
QdIknb1UOAMtOs+j8Or8XU4rpSUfZ6e+dBpYQAx2VwYVblA93I09QiPuDQLiRVJH
LFwviSAmP/iLoYsmmSojDKjm9cgR/DsOuYdmrwl8E4Yla+xuvSsoDKgjTPunoX7W
xXz+Gojn/HMRi0nC0YHLqR6/oNgCh6XcCdmMt4BrU++YUvdJr1bJysr1dqXxOQUX
NLFOwI3QII1sXsSLCn8+ym12j5qoTHwpQxOEiHZV8AGWOqedUWyeKitcPL/q+Qot
WCazaAvStbomXYpZwUC4Z0k2CgqCcwqRw+9gDq1OWuNKMd62LIKhInepwLiJ4uyD
2aDGXT1h5C7jKudAxhWhEKIG9UkQbzym11bVOynlaH1lXFAXq76vXm93T6aqi8Kj
ne0+8FJzDag/ymM2He/wcudTwk55pI+Y7ptlk+bQQ5R20y844eOQz8548UNH6XuT
EQR6K9+A4ct5O562HY6GcGroViNJsGbCdXC+uCG+3AFsWGJ1yKSua1bVbiHUUQ8E
hT0cOZ8wTikKbwKl1HApyyugyUM0NwAXkOXQEsUy5qVSP1ptMXlE+VnkoKoeaek+
ExPJiuBREVHPxRiAlSGZTXIUVGsTP/BFDaRX6D4f7QfT8nDUzthOhyZFSPq+/E+M
duhJK+NcOBU=
=3GmU
-----END PGP SIGNATURE-----