HPUX 11.0 Telnet reverse lookup question

[Dan Ryan_4]

My network admin was asked the following question:

Do the SAP servers do any kind of reverse lookup on telnet clients?

Our SAP server are HP9000 N400 running HPUX 11.0, so he is interested if telnet is doing a reverse lookup.

As far as I know there is arp/rarp we don't have rarp activated and I can see entries in the arp cache on the servers.
Then there is DNS reverse IP resolution. How do I determine if Telnet is DNS reverase IP resoluition?

Thanks for you help

[Steven E. Protter]

It you are using telnet that depends on your telnet configuration.

inetd -l

tail -f /var/adm/syslog/syslog.log

You will see your telnet logins and the available information on screen.

Certainly reverse lookup is possible. The sendmail hack that denies mail to any user that does not have a reverse DNS address was working on my HP-9000 servers before I pulled them out of the US into their current R&D role.

As to whether you can deny service on this basis, thats beyond my current knowledge.

Its probably possible to log this information though and even scan syslog and add entries of inappropriate traffic to a firewal configuration file.

Possible help:
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=809515
http://www.hp.com/products1/unix/operating/internet/RFC.html

Neither looks highly promising but may lead to better links.
SEP

[Bill Hassell]

telnet (and rcp, rlogin, remsh) commands always perform a reverse lookup as part of a rudimentary security control. That's why the 'r' commands fail if you put a simple hostname in the .rhosts file which does not map both ways (IP->hostname hostname->IP). With telnet, if reverse IP lookup fails, then the rest of the DNS servers in /etc/resolv.conf will be queried (lengthy timeoputs) and finally, telnet will get connected (30-90 seconds later). You can safely assume that all Unix systems may use reverse DNS lookups. This is a common oversight by DNS admins when the DNS server is Windows-based. It is good network security practice to always provide reverse IP lookup.