I have some Linux servers on my local network. When I connect to them via SSH or VNC, I can either use the local 10.0.x.x IP address my router assigns, or I can use the zeroconf "hostname.local" address that they broadcast themselves.

The zeroconf address just seems too convenient.

Are there any security concerns specifically related to relying on zeroconf domain names that would not be an issue with local IPs?

  • Using a name instead of an IP is just another additional thing that can go wrong.
    – Overmind
    Jul 25 '18 at 8:34
  • @Overmind How, specifically, could it go wrong?
    – Robert
    Jul 25 '18 at 8:36
  • As in local hostname not resolving.
    – Overmind
    Jul 25 '18 at 10:21
  • @Overmind What would cause that? And is it a security concern?
    – Robert
    Jul 26 '18 at 4:07
  • Not a security problem, just a possible standard error that can be prevented.
    – Overmind
    Jul 26 '18 at 5:36

SSH stores host keys. If the host key is not matching what is expected for a given name or IP, you will at the very least get a warning with all SSH implementations I've tried. OpenSSH will by default reject the connection, and you will have to manually run a command to remove the offending key.

VNC does not have this protection, but you can wrap it inside SSH to achieve same protection as SSH offers against MiTM.

  • And if you use a name the first time, OpenSSH records in known_hosts both the name and the address, and will subequently recognize either. Aug 1 '18 at 1:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.