1

I have some Linux servers on my local network. When I connect to them via SSH or VNC, I can either use the local 10.0.x.x IP address my router assigns, or I can use the zeroconf "hostname.local" address that they broadcast themselves.

The zeroconf address just seems too convenient.

Are there any security concerns specifically related to relying on zeroconf domain names that would not be an issue with local IPs?

Improve this question
5
  • Using a name instead of an IP is just another additional thing that can go wrong.
    – Overmind
    Jul 25, 2018 at 8:34
  • @Overmind How, specifically, could it go wrong?
    – Robert
    Jul 25, 2018 at 8:36
  • As in local hostname not resolving.
    – Overmind
    Jul 25, 2018 at 10:21
  • @Overmind What would cause that? And is it a security concern?
    – Robert
    Jul 26, 2018 at 4:07
  • Not a security problem, just a possible standard error that can be prevented.
    – Overmind
    Jul 26, 2018 at 5:36

1 Answer 1

Reset to default
1

SSH stores host keys. If the host key is not matching what is expected for a given name or IP, you will at the very least get a warning with all SSH implementations I've tried. OpenSSH will by default reject the connection, and you will have to manually run a command to remove the offending key.

VNC does not have this protection, but you can wrap it inside SSH to achieve same protection as SSH offers against MiTM.

Improve this answer
1
  • And if you use a name the first time, OpenSSH records in known_hosts both the name and the address, and will subequently recognize either.
    – dave_thompson_085
    Aug 1, 2018 at 1:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .