-
-
Notifications
You must be signed in to change notification settings - Fork 6.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
local hostname leak with NTLM authentication #8859
Comments
This is probably seen here:
|
The host name is passed in the auth messaging, by design. Are you proposing we should rather invent a fake name to pass on? I don't know how much checking of the host name is actually done by real world servers. NTLM is a horrible thing. Don't use it. |
I see that Firefox for example, sets the hostname to "WORKSTATION". I did a couple of tests with the NTLM auth and a fake hostname and it does not seem to have any effect, also, the I think that setting the hostname to either "WORKSTATION" or "null" can be an option and would not leak by default the host hostname. Of course more testing is ideal. Just a thought. Thanks for the work with curl! |
The NTLM protocol includes providing the local host name, but apparently other implementations already provide a fixed fake name instead to avoid leaking the real local name. The exact name used is 'curlhost', picked for convenience because this is the hostname we've set and used in local test cases so with using this we don't have to update tests! Fixes #8859 Reported-by: Carlo Alberto
Hi, I am pretty sure this is by design, but I do not see the real reason behind it.
While using curl with
--ntlm
or--negotiate
, the local hostname is sent out to the server.This is seen in the
NTLMSSP_AUTH
packet.Is this really needed? If so, I would be delighted to learn the reason.
It seems a bit like an unnecessary information leak.
curl/libcurl version
operating system
Debian 5.16.14
The text was updated successfully, but these errors were encountered: