Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using ConfigServer Security & Firewall (CSF) to limit port access to whitelist IP addresses. However I have heard that IP addresses can be spoofed. How wide-spread is this problem, and is it something I should be concerned with?

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

On a lot of consumer internet networks, I can just set my IP to that of the neighbors and have their IP, so yeah, IP's can be spoofed. Colocated servers also often share one subnet among different customers. Just DOS the machine so it goes down, take over its IP and you're done...

Anyway, it depends on your situation. Do you have data which you expect to be stolen, or tried to be stolen? Then you need more security than IP whitelisting. However, will it be a 'normal' (web)server, then usually even IP restrictions are only necessary for flakey software like PHPMyadmin. Software like SSH for instance won't just be cracked, because OpenSSH is strictly audited. Even DenyHosts (deny IP's that try to login frequently) is unnecessary and mostly annoying (I've been blocked out of my own machines quite frequently...).

My experience is that if you don't have data someone else wants, your biggest problem is automated scans for things like flakey PHP sites to send spam through. The most simple security measures, like IP whitelisting or running on a different port, are often enough for that.

share|improve this answer
    
I'm running a VPS as a "normal" webserver. My concern related mainly as to whether SSH can fooled by someone "pretending" to have my IP address... if that were possible. –  Owen Feb 16 '11 at 21:10
    
Technically yes, but if your password is secure (or if you have no password at all and use public/private key authentication), this is no concern. SSH servers are probed and scanned all the time, but unless you have a root account with password root123, you don't have to worry :) SSH is one of the services I would never hide behind a whitelist, because then at least you can login everywhere and add your current IP to the list of other services. –  Halfgaar Feb 17 '11 at 8:56
add comment

Check out this question over on security stack exchange - lots of useful answers.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.