0

The business I work for has a website for employees to clock in and out of their work shifts.

This website needs to be only accessible from our two in-house iPads. I tried doing a simple .htaccess password protection to the directory, but every time the browser is closed (which is often), we need to re-input the password.

I thought about limiting access to the iPads' IP addresses (also with .htaccess), but they have dynamic IP's so that doesn't work either.

What other solutions are there? Is there a way to make a website device-specific regardless of IP? A way to somehow "catch" the range of an iPad's dynamic IP's?

I am a newbie with PHP so please be clear with your answers. Any help would be greatly appreciated!

2 Answers 2

2

I'm going to go ahead and preach the VPN option. All you have to do is setup a small and simple OpenVPN server and the web server. Generate certificates for each iPad, then allow only the IPs from the VPN to access the website in question.

OpenVPN can be hard at first but once you start playing around with it, it should rapidly get simpler.

The solution mentioned by Arenstar only works if there is no NAT between the iPad's and the server.

I believe you do need a jailbroken iPad to install GuizmOVPN. It works really well. My boss uses his iPad to SSH into our servers and he's satisfied. The configuration of GuizmOVPN is not as simple as it should be but the tutorial on the website is rather clear.

2
  • +1 ; Security solutions based entirely on easily-spoofed information aren't worth the time spent implementing them, generally. If such a thing is "good enough", then you probably don't even need to bother in the first place. Nov 15, 2010 at 9:06
  • Its ok.. i agree on this too.. :) hehe +1
    – Arenstar
    Nov 15, 2010 at 9:13
0

I would most probably, for a simple quick fix..

  • Use the Ipads MAC Address's to Deliver -> IP address's across DHCP

  • Allow those IP address's from Apache -> to your application..

However there is no security from, faking the MAC address (getting the IP) and accessing the website on another internal computer..

You could also consider a VPN ( sounds perhaps crazy, but would work and offer a little more security )

.htaccess

AuthName "Secure"
AuthType Basic 
<Limit GET POST>
order allow,deny
allow from ipad1-ipaddr
allow from ipad2-ipaddr
deny from all
</Limit>

Using Apache you can control which users can view the website..
The website itself does not need to change..
httpAuth provides this functionality..
http://httpd.apache.org/docs/2.0/howto/auth.html

3
  • Hi Arenstar. This doesn't need to be bulletproof right now. None of our employees would know how to fake a MAC address. Do you think you could explain how I would use the iPad's MAC address to log in with PHP? I don't know anything about Apache. Nov 15, 2010 at 8:44
  • Your help is much appreciated Nov 15, 2010 at 8:45
  • You have a server somewhere in your office/location which provides a dhcp server.. In this dhcp server you would put the mac address of the ipad on a static ip.. So every time the ipad asked the dhcp server for an ip ( it will get the same one)
    – Arenstar
    Nov 15, 2010 at 8:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .