Binding to 0.0.0.0 is a bad practice about puppet-unbound HOT 6 CLOSED

#185 should resolve this. Thanks for sending the note.

from puppet-unbound.

@xaque208 below is what the unbound man page states so interfaces should probably be set to ['::1', '127.0.0.1'] however that is likely to break some setups

 Interface  to  use  to connect to the network. This interface is
              listened to for queries from clients, and answers to clients are
              given  from  it.  Can be given multiple times to work on several
              interfaces. If none are given the default is to listen to local-
              host.   The  interfaces  are not changed on a reload (kill -HUP)
              but only on restart.  A port number can be specified with  @port
              (without spaces between interface and port number), if not spec-
              ified the default port (from port) is used.

from puppet-unbound.

Thank you for sending the note.

I think its just the example that could be updated here. We also require the user to pass in the listen address, as well as the access list that will be allowed query, but the user is expected to know the impact of the values they enter since its entirely site specific.

Its worth noting, binding does not alone allow connections. Other security mechanisms that are beyond the scope of this module might be in place, such as packet filtering. Also, the service itself has a notion of providing access from particular prefixes, so merely binding to an address is not necessarily sufficient to provide access. Also, due to the often public nature of DNS, I don't really see this as bad practice or an issue generally, but perhaps I'm overlooking something. My personal expectation of deployment of DNS infrastructure is that the security decisions around DNS are weighed to determine the impact to the particular deployment, which is quite specific to the need of that infrastructure.

For example, I have private zones on servers that are not reachable from the internet, so binding to ::0 might be acceptable for me. In other cases, if one were to attach a DNS server to the internet, one might presume that the server in question is there to serve queries from the internet, in which case, the bind address is nearly irrelevant as long as the access list allows the specifics and the address that is bound is reachable.

The example in question I believe is the only place that we're referencing 0.0.0.0, and so I can see an update there being useful to demonstrate that users can specify specific addresses that they wish to listen on.

from puppet-unbound.

Very insightful, thanks!
I think this particular instance can be considered as a smell, something that deserves attention, but may not always lead to vulnerabilities.

from puppet-unbound.

@xaque208 i agree with all yu have said and dont see this as much of an issue, however i wanted to point out that this is not just in the example, the default does bind to 0.0.0.0, ::0

from puppet-unbound.

Ah yeah, I see it now. If we want to bubble up the default from unbound, it sounds like maybe we move that default to be undef, and avoid putting the listen line in the config. This would require the user to pass in the listen address, and a major version bump the module with a good changelog and readme update.

from puppet-unbound.