9/24    How do I find out what machines are in a certain domain, e.g.
        http://laney.edu?  Thanks.
        \_ ping -f http://laney.edu
        \_ a little command many people forget about: host -l http://laney.edu
        \_ echo "What machines are in your domain?" | mail postmaster@laney.edu
                \-You have to be so tall ... /tmp/laney.edu --psb
           You could try to use nslookup's ls command to list everything in the
           domain, but most nameservers (including http://laney.edu's) won't let you.
                \-"You have to be this tall ... " ... /tmp/laney.edu --psb
           \_ you could get a map of what network addresses they use, and then
              try to get reverse dns mappings for everything in those addresses.
              This is why disabling zone transfers on a nameserver (i.e. ls)
              is pretty stupid unless you kill reverse dns too. -ERic
                \_ Disabling zone transfers stops the script kiddies for now
                   (until someone takes pity on them and writes them a script
                    to do things the hard way)
                   \_ so until then you end up making it harder on everyone
                       else.
                        \_ stupidity in the name of security is rampant.
                           See soda's relaying policy.  -tom
                        \_ most everyone else doesn't need to do a zone xfer
                           or can ask nicely for one
                           \_ Disallowing them is a security through obscurity
                              policy, and impedes curiosity.  It's like turning
                              off finger on Unix.  Besides, crackers can still
                              scan easily, even without using DNS.
                                \_ or it's like using shadowed passwords
                                   \_ WTF are you smoking!?  Non shadow-passwd
                                      files are a huge security hole.  Give
                                      any user on your system instant access
                                      to all the poor sops' accounts and files
                                      who can't pick a decent password.
                                        \_ unshadowed passwrds aren't the
                                           cause of the security hole, stupid
                                           users are
                                \_ shadowed passwords provide little real
                                   security; it's not difficult to get the
                                   shadow file without root.  -tom
                                   \_ Um, by that logic, it's not hard to get
                                      root, so why bother having any security
                                      at all  --dbushong
                                   \_ Tom, you were the one who suggested
                                      using shadowed passwds and have, until
                                      now, continued to do so on the basis that
                                      it was "more secure" for at least 4 years
                                      now, see CSUA/OCF/XCF Help Session handout
                                      by Tom Holub
                                        \_ I haven't updated that in quite
                                           some time; I haven't taught the
                                           security help session in something
                                           like 3 years.  At the time, I
                                           wasn't aware that programs such as
                                           ftpd can leave large swaths of the
                                           shadow file in core dumps.  -tom
                                \_ That's not the logic.  The logic is that
                                   shadowed passwords provide a false sense
                                   of security.  The security problem with
                                   non-shadowed passwords is having bad
                                   passwords; having shadowed passwords does
                                   little or nothing to alleviate the only
                                   problem it could theoretically solve. -tom
                                        \-i think turning off zone xfers is
                                        basically free to do. of course you
                                        shouldnt rely on it and what is really
                                        the important thing to do is to be able
                                        to see who is asking forone and what
                                        they do right after that. a zone xfer
                                        a pretty good indicator of certain
                                        types of scans/signatures of certain
                                        tools. --psb
                                        \_ Or just curious network users.
                                           E.g. zone transfer of various
                                           things under http://mit.edu is fun.
                \_ Please define "zone transfer"        -- clueless
                   \_ Simple answer: it's what you get when you run
                        host -l or nslookup ls.  Long answer: Read the
                        BIND book from O'Reilley