Re: [authmeth] secure derivations of server hostname

[Michael Ströder <michael@stroeder.com>]

Kurt D. Zeilenga wrote:
> At 12:53 PM 6/30/2003, Michael Ströder wrote:
>
> > Kurt D. Zeilenga wrote:
> >
> > > I'll give two examples.
> > > 1) a client could derive a hostname from "localhost" in a secure fashion.
> >
> > How?
>
> By use of gethostname(3) or the like.

Note that on most systems localhost is rarely the same like the machine's 
host name.

E.g. on a Linux box the interface lo (loopback-device) with IP addr 
127.0.0.1 and name localhost is definitely something different than eth0 
with different IP addr assigned matching the machine's host name.

And not every service binds to all available interface when running on a 
machine.

I see some risks when relaxing the host name check.

Ciao, Michael.