[PATCH] UseDNS should default to "no"

[Christoph Anton Mitterer]

On Wed, 2014-11-12 at 01:43 -1000, Daniel Kahn Gillmor wrote: 
> What do other folks think is the right way to improve the default
> behavior here?

I'd probably:
- default UseDNS = no, since it provides a false sense of security

- I'd also go for -u0 per default, even though one should probably
double check if that might somehow affect logging as used by prominent
software like fail2ban

- not sure what to do about from="pattern-list"... perhaps adding a
warning there that using domainnames may be insecure anyway,.. perhaps
adding a further option that enables/disables DNS for it?


Apart form that UseDNS seems to be kinda misnomer... normally I'd expect
from the name, that if I say UseDNS=no, then DNS is never used.
But actually it's something different...


Cheers,
Chris.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5313 bytes
Desc: not available
URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20141112/d1b87ab4/attachment-0001.bin>