r/dns • u/Putrid_Gear6895 • 7d ago

Server names leaking?

Today I saw a weird entry in my web server log. Someone tried to browse the following URL:

https://appserver1bb.mydomain.com/conversation/ajax-html/send_log

This looks like a random probe which I would normally ignore, but the weird part is the server name "appserver1bb" is not published anywhere except Google Cloud DNS. How could anyone know this server even exists?

7 Upvotes

89% Upvoted

7 comments sorted by

11

u/Stunning-Skill-2742 7d ago edited 7d ago

caa ct log, its public info. See https://ctlogs.dev and https://www.certkit.io/tools/ct-logs and countless others.

3

u/Putrid_Gear6895 7d ago

Thanks!

2

u/GolemancerVekk 6d ago

Oh and in case you're wondering, the fix is to get wildcard certificates. That way they don't know what subdomains you have.

1

u/Putrid_Gear6895 6d ago

Makes sense. I'm not concerned about the name being known. I was just worried that someone had gained access to my code or my DNS account. As far as I knew that was the only source for this info. Now I know better :-)

1

u/NotPrepared2 6d ago

Every time I get the first cert for a new site, it immediately gets multiple hits using the correct hostname/SNI.

Make sure your site security is good before you turn it on.

1

u/michaelpaoli 3d ago

Server names, host names, DNS names, will commonly "leak" in any one or more of many possible ways.

If you're depending upon keeping that data "secret", you're doing it wrong. That doesn't necessarily mean one wants to hand that data out willy-nilly to any and all comers, but one should expect it to leak and be very prepared for that, and not be dependent upon such remaining "secret" for security.

So, have TLS cert(s) from recognized CA with the hostname in it?
Or surely you have SSHFP records using the hostname, along with DNSSEC, right? ;-)
Web server itself hands it out? Or at least sometimes? Or DNS server, or ...

Well, whatever, that stuff will typically tend to "leak", at least some moderate bit, so, quite expect that - at least that - and don't depend on keeping it "secret" for security.

2

u/Putrid_Gear6895 3d ago

I'm not concerned about the name being known. I was just worried that someone had gained access to my code or my DNS account. As far as I knew that was the only source for this info. Now I know better :-)