3

We are all pretty comfortable with the fact that if ports 80 and 443 are open that these are for http even though some companies block 22 forcing people to repurpose 443 for ssh. So, those instances notwithstanding, does describing public services with SRV records make your system any more vulnerable than another sort of port relocation? 22->2222 etc...

(Consider that my network is still port mapped by China and Russia at least once a day or over the course of a few days. It would be great if my firewall could detect and blacklist them but that'll just escalate the issue)

Improve this question
3
  • More "vulnerable"? No. Are you asking about the risks or vulnerabilities?
    – schroeder ♦
    Commented Feb 24, 2018 at 20:14
  • I think risk and vulnerable are the same... if I mapped my network ports in SRV records then the attacker does not have to portscan and can attack a particular port/service that have a wellknown weakness before IDS or fail2ban targets the attacker.
    – Richard
    Commented Feb 25, 2018 at 20:49
  • 1
    The vulnerability remains the same. The only change is the time to find it.
    – schroeder ♦
    Commented Feb 25, 2018 at 21:21

2 Answers 2

Reset to default
5

A SRV record defines the location of a service. It doesn't provide or expose that service. Your server (along with any firewalls you implement) provides and exposes the service, so I don't see how/why the existence of an SRV record makes you any more or less vulnerable. If you provide and expose HTTP, SMTP, SSH, etc., etc. then it matters little how a potential hacker finds those services.

Improve this answer
2
  • 2
    While both answers have their merits, I'm going to have to go with this one. On an IPv4 network, it's somewhat beside the point because your network is so easy to port scan. On an IPv6 network, it takes longer to scan without knowing more about your victim but you have to operate under the assumption that any exposed port is going to be discovered at some point anyway. At the end of the day, your security must be designed around the assumption that the attacker knows what you have exposed; security through obscurity won't save you.
    – Andrew B
    Commented Feb 24, 2018 at 23:55
  • but a port scan can be detected from the offending IP long before the port attack begins.
    – Richard
    Commented Feb 25, 2018 at 20:51
2

It depends on whether or not the SRV record can be used to identify the particular software/version running.

For common services such as auto configuring email, AD location, or, as mentioned in another answer, http, ssh, etc (no idea why you'd use a SRV record for these) it probably matters very little.

Where'd you'd want to be concerned is if you had a unique application listening on a special port. For example, say ACME Company produces "Specialized App" that defaults to listening on port 54321. You publish a SRV record pointing specialapp.yourdomain.com to your ip and port 54321. A hacker can then make an educated guess that you are running Specialized App published by ACME Company and attempt to exploit any past or currently known vulnerabilities in it.

Improve this answer
1
  • I have one public IP and 3 baremetal and one vmware device... I also do a lot of docker development and being able to deploy containers with a SRV tunnel would be part of any CI/CD assuming that the client also used the SRV.
    – Richard
    Commented Feb 25, 2018 at 20:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .