1

I have an idea I'd like to float to the smart people of serverFault to pick holes in it.

I'm looking for a way to lock down a 3rd party application in IIS. It's a web service, so there's no login page or anything, it's meant for use in a VPN environment. I'm trying to put it online without a VPN and am thinking of ways to add some sort of security to it. I need to restrict it to certain networks, its a business product, so I can probably get away with saying that you need to be on a private network (ie not public wifi) to use it. My idea is to use IP Address Restriction in IIS, and write an app that the users install and have it update the server with their current IP every few minutes, the server then blocks all except the ones recently updated.

How secure would this be? Is there a major flaw in this idea? Or is there perhaps a better way to do this in IIS?

5
  • 2
    Is there some reason why you can't simply setup authentication? You could authentication via HTTP, SSL certificates.
    – Zoredache
    May 18, 2011 at 23:51
  • To Zoredache's point, I don't know IIS but you could accomplish this with an Apache proxy in front of the web application that requires users to pass http basic auth against, say, an Active Directory server.
    – Kyle Smith
    May 19, 2011 at 0:59
  • I'm not sure what exactly you mean. The application is a WCF web service app, there's no actual web page and I don't have access to change the code. All I know is that it adds 5 web apps and 1 virtual directory under the default website. Are you saying I should setup these authentication methods goo.gl/k0ez3 on the default website. Could I then make an application that automatically authenticates this for the user and retains it for all of those 5 web apps?
    – RodH257
    May 19, 2011 at 2:45
  • you wouldn't need to change the app to add authentication, it can be done at the IIS level.
    – Sam Cogan
    May 19, 2011 at 7:42
  • Yeah I understand that but I guess my main concern is how do they actually login if there is no user interface on their end? the web service runs in the background on their computers, kind of a b2b type thing. If I turned on windows authentication, how would they then authenticate? Can I write a program that logs them in once and remembers it each service call?
    – RodH257
    May 19, 2011 at 11:02

2 Answers 2

0

I can see one major flaw with this - all an attacker has to do is hijack one communication and the app will then only talk to their computer. Realistically, it wouldn't be too hard to watch the traffic to see what would be required.

Of course you could use encryption using a public/private key pair to avoid this issue, then you are authenticating - which seems like a much better idea.

2
  • what do you mean by hijack communication? Get themselves on the authenticated list using my authentication app? Can you point me in the right direction for how i can use public/private key encryption, have a look at comments on the main post as to how the 3rd party app is set up, ie there is no UI and I'm not in control of the app at all - can I still somehow do public/private key auth? Have you got any links I can read on this?
    – RodH257
    May 20, 2011 at 0:11
  • Hi @Rod - if you have literally no access to modify the app, you may be better off adding something to the pathway for authentication. If you want to migrate or ask this question over at security.stackexchange.com there are some very experienced guys there who know this stuff in more detail than me.
    – Rory Alsop
    May 20, 2011 at 6:58
0

We used client certificates. They're required at the IIS level, not in the app so no mods there. Then anyone that wants in has to have a client cert issued by us so it doesn't matter where they run it from. Of course that doesn't restrict it to a certain network, just certain machines that have the cert.

3
  • What I don't understand is how the users computer sends the certificate? This isn't from within a browser, it's from a WCF windows application that I also have no control over. Does the OS automatically check all HTTP requests and do the appropriate certificate authentication? I probably just don't understand how this works, can you point me in the right direction of where to find out more, if indeed it does work outside of a browser?
    – RodH257
    Jun 11, 2011 at 10:12
  • My understanding is that the client certificates are installed on the user's PC, not into the browser. So the PC has the list of certificates. When the app (browser or otherwise) connects to the server, the server says: "Hey, do you have a cert that matches A? Cause you need one." and the client app checks its list of installed certs and presents the one that matches. Jun 15, 2011 at 21:00
  • I see, so in my instance I'll have to see if WCF itself actually does this automatically, or if WCF enabled applications have to do this. If WCF doesn't to it automatically I guess I'll be out of luck because there won't be any chance of the app supporting it natively.
    – RodH257
    Jun 16, 2011 at 12:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .