Preventing Use of Recursive Nameservers in Reflector Attacks
draft-ietf-dnsop-reflectors-are-evil-06

[This is a preliminary discuss; I reserve the right to add to it until the telechat on Thursday.
I wanted to get this issue filed as a discuss so people could think about it.]

The description of the attack in section 3 is sufficiently hard to
follow that I would have been unable to do so had it not been
presented in detail at the IAB workshop on unwanted traffic.  Start by
using less abbreviations and acronyms and see if that makes it clear
enough that it is easy to follow.

Paul Hoffman brought up a last call comment on the ietf list; I
believe this comment needs to be addressed.  I support discussing this
issue in the security considerations section.  I don't think we can
take a recommendation for or against using an open recursive name
server for roaming users; I don't see sufficient discussion to support
that either way.  However the recommendation in section 4 is worded in
such a way to allow organizations who have a need to do so to run open
recursive name servers.  I think that's fine and appropriate.  Please
add security considerations text to address Paul's issue without
making a recommendation about whether the practice is advisable.

Obviously factual discussion of the problems of that organizational
choice are appropriate.  Similarly, if you want to argue that my
reading of whether there is a consensus to recommend against this
practice exists I'll listen to your argument.

>The Security Considerations section for this document is much too
>narrow. It ignores one of the main reasons that many organizations
>purposely choose to provide recursive lookup to the public, namely for
>their own roaming users. Without an open, known-good nameserver at a
>fixed address, roaming users need to trust whatever is given to them
>by their ISP at the moment, and it is reasonable for organizations to
>consider this too large of a risk. Unless the organization has a way
>to tunnel DNS queries back to a non-recursive nameserver (such as
>through IPsec), having a recursive nameserver available increases the
>security of their roaming users.
>
>There are two major reasons for an organization to not want roaming
>users to trust locally-assigned DNS servers.
>
>- An attacker might have compromised the DHCP server to which the user
>conntect to point to a compromised DNS server. Although such an
>attacker can also cause the DHCP server to point to a compromised
>next-hop router, it is easier and less detectable for most attackers
>to compromise a DNS server than a router. There are plenty of examples
>where compromised DNS servers lead to spoofing and MITM attacks.
>
>- Some ISPs use DNS servers that purposely do not follow the same good
>practices that the organization uses. In particular, some ISPs have
>used bogus TLDs and name-lookup services to generate revenue.
>
>The Security Considerations section needs to deal with these issues,
>even if they do not change the advice given in section 4.