tcpd -DPARANOID doesn't work, and never did

[djb () CR YP TO (D. J. Bernstein)]

Once upon a time, rshd/rlogind checked for trusted hosts as follows:

   Use DNS PTR records to find a name for the remote IP address, and
   check that the name is in a list of trusted host names.

Of course, this check is worthless, even if you have secure IP and
secure DNS. An attacker simply sets up a PTR record from his own IP
address to one of your trusted host names.

This attack became widely known in mid-1991. Wietse Venema promptly
released a new version of his log_tcp package, with a tcpd -DPARANOID
option providing ``protection against rlogin and rsh attacks.'' System
administrators installed tcpd and breathed a collective sigh of relief.

But -DPARANOID didn't stop the attacks!

Here's the combined procedure used by tcpd -DPARANOID and rshd/rlogind
to check for trusted hosts:

   (1) Use DNS PTR records to find a name for the remote IP address.

   (2) Use DNS A records to find the IP addresses for that name.

   (3) Drop the connection if the remote IP address is not one of the
       IP addresses for that name.

   (4) Use DNS PTR records to find a name for the remote IP address,
       and check that the name is in a list of trusted host names.

The A records for all trusted hosts can be controlled locally. With
secure IP and secure DNS, there's no way for a trusted host name in #1
to survive the check in #3 unless the remote IP address is listed as an
A record for that name.

But who says the attacker has to use a trusted host name in #1? He
doesn't need a trusted host name until #4! The attacker simply

   * responds to the PTR query in #1 with a low-TTL name that points to
     an A record under his control;

   * pauses so that the PTR result is no longer cached;

   * responds to the A query in #2 with his IP address; and then

   * responds to the new PTR query in #4 with a trusted host name.

Nobody knows how many tcpd-``protected'' hosts were compromised through
this attack before vendors fixed their rshd/rlogind programs.

tcpd -DPARANOID is still the default today. People who try to use tcpd
for public services end up losing connections from thousands of hosts.
New sysadmins often have trouble tracking down the problem, since tcpd
doesn't take responsibility for its own error messages. I'm eliminating
tcpd from the qmail FAQ; the advantages of relying on familiar software
are outweighed by the -DPARANOID support hassle.

Cynics will note that there are many other examples of security scares
being exploited to sell software that adds far more inconvenience for
normal users than for attackers. No wonder security has such a bad name!

---Dan
1000 recipients, 28.8 modem, 10 seconds. http://pobox.com/~djb/qmail/mini.html