<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">If DNS caching is being disabled in
dnsmasq, what value is being had from using dnsmasq by default
with network connections? Seems like it just presents another
potential failure point.<br>
<br>
On 10/07/2012 09:19 AM, Stéphane Graber wrote:<br>
</div>
<blockquote cite="mid:5071D5A5.3040006@ubuntu.com" type="cite">
<pre wrap="">On 10/07/2012 04:32 AM, Benjamin Kerensa wrote:
</pre>
<blockquote type="cite">
<pre wrap="">
On Oct 7, 2012 12:28 AM, "Daniel J Blueman" <<a class="moz-txt-link-abbreviated" href="mailto:daniel@quora.org">daniel@quora.org</a>
<a class="moz-txt-link-rfc2396E" href="mailto:daniel@quora.org"><mailto:daniel@quora.org></a>> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">
DNS caching was previously disabled [1] when dnsmasq was introduced in
12.04 (one of the benefits), "to prevent privacy issues, and to
prevent local users from spying on source ports and trivially
performing a birthday attack in order to poison the cache".
Since dnsmasq eg introduced the standard port-randomisation
mitigations [2] for Birthday attacks in 2008 and related hardening,
what are the other technical reasons we should still keep this
disablement, despite upstream keeping DNS caching enabled? (ie should
upstream also disable DNS caching?)
Of course, the impact of disabling DNS caching is considerable.
Thanks!
Daniel
[1] <a class="moz-txt-link-freetext" href="https://bugs.launchpad.net/ubuntu/+source/network-manager/+bug/903854">https://bugs.launchpad.net/ubuntu/+source/network-manager/+bug/903854</a>
[2]
</pre>
</blockquote>
<pre wrap=""><a class="moz-txt-link-freetext" href="http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2008q3/002148.html">http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2008q3/002148.html</a>
</pre>
<blockquote type="cite">
<pre wrap="">--
Daniel J Blueman
</pre>
</blockquote>
<pre wrap="">
Good points it does look like hardening and addressing some of the
concerns has occurred it is possible perhaps that enabling caching was
just overlooked but either way it would be nice to see it enabled in 13.04.
</pre>
</blockquote>
<pre wrap="">
dnsmasq still doesn't support per-user caching so it still doesn't meet
the criteria we discussed with the security team last cycle and as such
as kept in its current configuration.
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
</body>
</html>