Hostname DNS Verification

To prevent potential abuse, PAM records can now perform hostname verification prior to executing tasks.

This can potentially reduce the ability to alter DNS in order to gain access to a managed Windows endpoint.

 

To implement hostname verification

1. Login to PAM with a System Administrator account.
2. Navigate to Administration > Record Types.
3. Locate the Record Type that you wish to enforce this verification on and click its Edit button.

We recommend, but do not require, creating a custom record type and inheriting from the Windows Host (or another) parent type rather than modifying any default types. For more information about Custom Record Types, please read this article.

4. On the Record Type’s page, scroll down and click the Add Field button. Configure the following values:

   • Field Type: Checkbox

   • Name: HostNameDNS

   • Display Name: Disable Hostname Verification (or another value of your choosing)

   • The remaining values can be configured to your requirements

5. Click the Save button on this Add Record Type Field page.

6. PAM will return you to the Record Type page, click this Save button to complete the configuration.

    

   

 

To test hostname verification, please perform the following steps:

1. Create a new record or reuse an existing record that utilizes the Record Type that was updated in the previous section.
2. On this new Disable Hostname Verification field, do not check this box. Unchecked/disabled means the hostname will be verified, while Checked/enabled means that verification will be skipped.
3. Execute a task against this record. Ensure that the hostname in the record will fail verification prior to executing this task.

When the task is executed, it will first verify the hostname defined in the record and in this scenario, this verification will fail. This will prevent the task from executing and it will therefore report a Status of Error and the details of this error will be reported as such:

Copy

1
Failure to verify host name hostname from the record, detected hostname detected on the endpoint.

Of course, if the verification is successful, then the task will be executed as expected.