New ZeroConf Spec

Dick Davies rasputnik at
Thu Jul 27 12:18:02 BST 2006

On 27/07/06, Dan Kegel <dank at> wrote:
> On 7/27/06, Dick Davies <rasputnik at> wrote:
> > If you use DNS based AAA mechanisms, then mDNS is probably not a good
> > idea. We all know this.
> I think what you're saying is "hostnames are useless for security with mDNS",
> and I agree.
> Currently, many applications assume that hostnames actually mean something,
> and use hostnames to identify resources.  (For instance, ssh, cups,
> and web browsers.)  I think those two facts together mean that
> anyone who uses ssh, cups, or web browsers probably shouldn't use mDNS.

Actually, SSHD is the sort of thing that I'd point to as a well-behaved app,
since it does application level checking
of endpoints (RSA/DSA keys). And cups already has a (crappy) discovery
mechanism by way of SLP. See below for web browserv.

> So, when we switch on Avahi and enter the brave new world of
> meaningless hostnames, how will we know which services to trust?

I think I'm starting to understand your horror at the whole idea, but I think
it's based on a misunderstanding of the impact this would have.

By default, DNS will still be the primary mechanism for name resolution.
To change that you'd have to

  1.install a NSS module to talk to avahi
  2. edit nsswitch.conf to explicitly enable mdns for the 'hosts' database.

EVEN THEN, nss-mdns will only do queries for the '.local' domain
(this can be changed, but is mad. I'm not even going to mention how you
do it. Suffice to say it requires explicit 'gimme danger' level work by someone
with root access).

Otherwise, only applications that explicitly ask for zeroconf name resolution
would be affected by this change in any way.

Rasputin :: Jack of All Trades - Master of Nuns

More information about the ubuntu-devel mailing list