RE: Should FW have DNS name?

A big problem with DNS records for firewalls is that firewall administrator may 
use the DNS entries to access the management functions of the firewall.  If 
your DNS server is compromised it is trivial to change the firewall DNS record 
to another IP address and the attacker now can capture your firewall 
administrator passwords and then own your firewall.
 
Thomas Harris 
Northrop Grumman ISS Site Lead 
GIAC Certified Firewall Analyst (GCFW)
GIAC Certified Intrusion Analyst (GCIA)

________________________________

From: Vladimir Mitiouchev [mailto:vovcia@gmail.com]
Sent: Thu 6/15/2006 6:09 PM
To: eldad gal
Cc: Craig Wright; terry white; firewalls@securityfocus.com
Subject: Re: Should FW have DNS name?



> Hi'
> I must say that security must build with as many obstacles on the path of an
> attacker to your net.
> Also there is the concept "security by obscurity".

Don't be silly. As terry wrote, security by obscurity is no security at all.

And, guys, You can kill me, but I really think easy management and
logical structure is more valuable than "securing" firewall by
"hiding" it, or other obscurity stuff.. You want to hide fw? Do it
full transparent, You know, accept&forward without changing TTL or
silently DROP. And do not give him an external IP.

And, damn, You are talking about such a silly things.. You all should
find some real problems.

--
Sincerely Yours,
Vladimir Mitiouchev