Paul Smith, what you describe is information leakage and shouldn't IMHO
work as you say by default.

Consider that I'm connected to a corporate network and have an
(untrusted) VPN active which I only want to use to access resources on
its network (never-default: yes). Then by having the resolver adding the
domain of the VPN network to short name lookups could leak those local
names to the remote VPN (depending on the order the lookups are
performed in) and potentially allow the untrusted network to take over
internal services that are accessed using short names. This could happen
by mistake also (such as setting "mail" as your smtp server if the
remote network uses the same name).

I don't think the order of the lookups can be controlled to prevent
this, for example what should determine the order when you have to VPN
active?

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1726124

Title:
  DNS domain search paths not updated when VPN started

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/network-manager/+bug/1726124/+subscriptions

-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to