I've been told in the past that you should never give out the host names of computers on your network. I can't think of any reason why this would be the case.
Could someone tell me if they should be considered sensitive information and if so, why?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Two reasons I can think of:
Firstly, it would be nice to define "give out". Not publish on external web sites? Internal web sites? Not put internal hosts into external DNS? Not create PTR records for? Not create A records for? You're asking a subtle cost-benefit question, and it's important to know the cost as well as the benefit.
The short answer to your question is, the issue people worry about is when:
When might information benefit an attacker? When it tells them what's attackable on a box. As @LateralFractal points out, "DB" in a hostname makes it more interesting than "DEV" or "TEST". If the attacker has access to (say) port 3306 over the network, then they probably would have figured out it's a DB anyway. On the other hand, if all they can access is port 80/443, and the name of the box is "MYSQLDB01", then that might guide them to the sort of web-based SQL attacks that will work with MySQL in preference to other database servers.
What I'm trying say is that it's a very nuanced judgement. And in my opinion, the practical value of hostnames is usually enough to outweigh most obfuscation or limitation upon functional DNS data. It's more important to help people do valid work than it is to try to discourage attackers who most likely have other methods of performing the same reconnaissance.
Outlook Web Access is a great example. By definition it is commonly exposed to the Internet without IP restrictions, allowing anybody to poke at it. Is there any security added by not to setting up valid forward and reverse DNS records for "owa.example.com" or "webmail.example.com"? No, because anyone who can go to port 443 - which is everyone - is going to get greeted by a welcome page that screams (either visually or with HTTP headers) that it's Outlook Web Access. You don't gain anything by obfuscating or limiting access to the name there.
On the other hand, if I have a server that needs to be on the Internet but I'd prefer not to advertise it ("backend-auth-proxy.example.com"), I'll name it Enterprise. Tardis. Klaatu. The sort of generic geeky system administrator-chosen name that doesn't stand out from the million other boxes like it :) Hide things in plain sight rather than trying to limit access to names.
In addition to Lateral's answer, you can't guarantee your hostnames wont be used in another unforeseen way. Certain protocols require the correct hostname to work (NTLM, and possibly kerberos). If an attacker doesn't have the IP addresses, an external attacker can use the hostnames to perform attacks. A lot of times web application attacks will get you inside the firewall, but it can be tough to find a listening host, especially if you don't know their addressing scheme.