Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an idea I'd like to float to the smart people of serverFault to pick holes in it.

I'm looking for a way to lock down a 3rd party application in IIS. It's a web service, so there's no login page or anything, it's meant for use in a VPN environment. I'm trying to put it online without a VPN and am thinking of ways to add some sort of security to it. I need to restrict it to certain networks, its a business product, so I can probably get away with saying that you need to be on a private network (ie not public wifi) to use it. My idea is to use IP Address Restriction in IIS, and write an app that the users install and have it update the server with their current IP every few minutes, the server then blocks all except the ones recently updated.

How secure would this be? Is there a major flaw in this idea? Or is there perhaps a better way to do this in IIS?

share|improve this question
Is there some reason why you can't simply setup authentication? You could authentication via HTTP, SSL certificates. – Zoredache May 18 '11 at 23:51
To Zoredache's point, I don't know IIS but you could accomplish this with an Apache proxy in front of the web application that requires users to pass http basic auth against, say, an Active Directory server. – Kyle Smith May 19 '11 at 0:59
I'm not sure what exactly you mean. The application is a WCF web service app, there's no actual web page and I don't have access to change the code. All I know is that it adds 5 web apps and 1 virtual directory under the default website. Are you saying I should setup these authentication methods on the default website. Could I then make an application that automatically authenticates this for the user and retains it for all of those 5 web apps? – RodH257 May 19 '11 at 2:45
you wouldn't need to change the app to add authentication, it can be done at the IIS level. – Sam May 19 '11 at 7:42
Yeah I understand that but I guess my main concern is how do they actually login if there is no user interface on their end? the web service runs in the background on their computers, kind of a b2b type thing. If I turned on windows authentication, how would they then authenticate? Can I write a program that logs them in once and remembers it each service call? – RodH257 May 19 '11 at 11:02

I can see one major flaw with this - all an attacker has to do is hijack one communication and the app will then only talk to their computer. Realistically, it wouldn't be too hard to watch the traffic to see what would be required.

Of course you could use encryption using a public/private key pair to avoid this issue, then you are authenticating - which seems like a much better idea.

share|improve this answer
what do you mean by hijack communication? Get themselves on the authenticated list using my authentication app? Can you point me in the right direction for how i can use public/private key encryption, have a look at comments on the main post as to how the 3rd party app is set up, ie there is no UI and I'm not in control of the app at all - can I still somehow do public/private key auth? Have you got any links I can read on this? – RodH257 May 20 '11 at 0:11
Hi @Rod - if you have literally no access to modify the app, you may be better off adding something to the pathway for authentication. If you want to migrate or ask this question over at there are some very experienced guys there who know this stuff in more detail than me. – Rory Alsop May 20 '11 at 6:58

We used client certificates. They're required at the IIS level, not in the app so no mods there. Then anyone that wants in has to have a client cert issued by us so it doesn't matter where they run it from. Of course that doesn't restrict it to a certain network, just certain machines that have the cert.

share|improve this answer
What I don't understand is how the users computer sends the certificate? This isn't from within a browser, it's from a WCF windows application that I also have no control over. Does the OS automatically check all HTTP requests and do the appropriate certificate authentication? I probably just don't understand how this works, can you point me in the right direction of where to find out more, if indeed it does work outside of a browser? – RodH257 Jun 11 '11 at 10:12
My understanding is that the client certificates are installed on the user's PC, not into the browser. So the PC has the list of certificates. When the app (browser or otherwise) connects to the server, the server says: "Hey, do you have a cert that matches A? Cause you need one." and the client app checks its list of installed certs and presents the one that matches. – Phillip Jubb Jun 15 '11 at 21:00
I see, so in my instance I'll have to see if WCF itself actually does this automatically, or if WCF enabled applications have to do this. If WCF doesn't to it automatically I guess I'll be out of luck because there won't be any chance of the app supporting it natively. – RodH257 Jun 16 '11 at 12:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.