>Please note that this SetHostname command does not in any way change the
>hostname of the computer.. only that which Avahi represents itself on
>the local un-trusted mDNS domain.

Kinda. More accurately, SetHostname command affects how the host represents
itself to all other hosts that have a connection to it on that network
interface card (whether on Avahi or not), which hoses up, inter alia, any
Static IPs set by the DHCP server based on the send host name statement in
dhclient.conf.

See the LSB specification for sethostname at:
http://refspecs.freestandards.org/LSB_3.1.0/LSB-Core-generic/LSB-Core-generic/baselib-sethostname-2.html

See also the gethostbyname and hostname manpages.


> this is not much of a security risk and at worst a nuisance.

If you are the network admin of a company or a university, allowing
untrusted users to change how the computer represents itself on the network
is a definite security risk. Essentially, it allows breaking through
departmental or other information segregation policies over the Avahi mDNS
domain, without the ability to control dissemination of the information by
management. For publicly traded companies in the United States, that would
expose management to Sarbanes-Oxley liability.


Avahi is a boogered-up mess.

-- 
Loye Young
Isaac & Young Computer Company
Laredo, Texas
(956) 857-1172
[EMAIL PROTECTED]

-- 
SetHostName can be called by users
https://bugs.launchpad.net/bugs/195140
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to