I have a website which I want to use for administrative purposes. I need to be sure that only people from certain machines can log on. the problem is they are on ISP networks. Will I truely get the correct IP address to use from an ip/ifconfig command, or must I worry about NAT being used by ISP ?
2 Answers
You're Doing It Wrong my friend.
Aside from both local NAT and "Carrier-Grade NAT" (which mean the information you get from ifconfig
on client systems may be a private address that you can't use in your server's access lists), IP-based security is a farce: ISPs may change public network assignments, end-users may be on dynamic IPs, or someone might spoof BGP and lie their way past your security.
If you want to properly secure your site my recommendations would be:
SSL with mutual certificate authentication
Very secure, supported by pretty much every browser, but a bit of a pain in the butt to administer because you need to issue client certificates to all your users and explain how to install them (and the certs are tied to the machines you install them on so your users may not be able to log in from Grandma's house).
Totally worth it if you need the security though.SSL and Two-Factor Authentication
Using something like Google Authenticator in addition to a username/password, giving your users real Two-Factor authentication (Something you know - Username/Password, and Something you have - the device with Authenticator running on it).
This may require a little work on your part, either in your app or on the server with something likemod_auth_external
, but it's very good security: It doesn't suffer the limitations of mutual certificate authentication, and it's nigh-impossible to brute force.SSL and Username/Password Authentication
Only as secure as the username/password, but that's why we have good password policies.
This is susceptible to brute-force attacks, so mitigation techniques would need to be employed.
The easiest way to determine this is to run the following on the system you plan to allow access.
lynx ipchicken.com
If it matches your ifconfig you should be good to go. If not and it's a home router you'll be trusting the machines behind the individuals router. Another way you could do this is require vpn with credentials and only make ths site available within your network. Then you could require keys or a certificate.
we've always done it this way
doesn't mean it's a good solution" -- Username/Password authentication is pretty awful from a security standpoint)%
" -- kill me now!) -- My freakin' Blizzard gaming account is more secure than any of those...