-2

I know I can whitelist a client IP for connecting to SSH on server and then Deny All other IPs. However, seeing as how the packet arriving at the server network interface must include the IP, what is stopping someone just pretending to be the whitelisted IP?

Improve this question

2 Answers 2

Reset to default
6

To be clear: the packets that return from your server will go to the IP address that the packets claim to be from, and not to where they actually came from.

IP traffic flows are not "pipes". :)

If the imposter sends a packet which says "My source address is x.x.x.x", your server will send its reply to x.x.x.x, and not to the imposter. So even if they controlled one router along the path, that wouldn't be enough to ensure the return packets arrive.

Improve this answer
2
  • ...but there could be a theoretical chance that, by controlling one router on one of the many paths they could see the reply? And if they got physically close enough to the server they would likely increase their chance as the number of routers connecting to the server decreases. So then just try and connect over and over until they get lucky and catch the handshake? I can't see how this is not possible?
    – Zuriar
    Dec 14, 2014 at 17:24
  • There's no luck involved, and no "catching the handshake". Each router along the path either knows a route to the remote IP (x.x.x.x) or it doesn't (and uses its default route). I don't know what you mean by getting "physically close enough to the server". If there is one router between them and the target and they control that router, great, they win. If there are two, they need to control both. If there are ten... you get the picture. If you don't see how this is possible, I recommend you read up a bit on IP fundamentals.
    – DictatorBob
    Dec 14, 2014 at 17:31
2

The fact that they won't receive the reply and thus can't complete the three-way handshake.

Improve this answer
4
  • how can one be sure that they won't receive the reply? Is there not a chance that they could control a router which is on the return path the response/reply would take?
    – Zuriar
    Dec 14, 2014 at 17:11
  • @user3231690 Only if they're the NSA. And if the NSA wants you, you've got more serious problems than this...
    – Michael Hampton
    Dec 14, 2014 at 17:13
  • Why would it need to be the NSA? Surely all it needs to be is someone who has access to one of the closer routers to the Server?
    – Zuriar
    Dec 14, 2014 at 17:21
  • See my comment below, but you're missing a fundamental notion of routing. Each router along the path will try to route the packet to the real destination, and not to the attacker. In the "bad old days" of the Internet, things like source routing were possible (the source could specify the return path) but that's practically impossible these days.
    – DictatorBob
    Dec 14, 2014 at 17:33

Not the answer you're looking for? Browse other questions tagged .