Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Usually it is advised, when one wants to secure an application, to "provide" as little information, or better yet, no information at all to unauthorized (possibly malicious) users. I'm thinking of information like OS, app version, etc.

My question is the following:
I have a web application that allows access only from specific IPs, the rest of the world gets an HTTP Forbidden response. I was wondering, in the context of security mentioned above, is there anything wrong? I mean I guess an intruder would know that an HTTP server is running but would not be able to access it.

Is there a security issue because of this? Could it be improved somehow?
UPDATE:
I am also using authentication via username and password but if the source IP is not in the allowed list they do not get a username/password prompt page. Just forbidden

share|improve this question
    
What error code is returned when a unallowed IP address makes a request? –  this.josh Jul 9 '11 at 15:13
add comment

3 Answers

up vote 5 down vote accepted

If your web server is only serving specific IPs, it's probably a better idea to only allow those IPs in your firewall.

share|improve this answer
    
The spoofing of IP addresses as mentioned by Legolas, isn't it an issue in firewall as well? –  Jim Jul 9 '11 at 6:27
    
@Jim of course it is, but you said that this is your preferred method of authentication, so you probably understands that spoofing is a risk. But IP spoofing is not an easy thing to do in the internet, so if you don't use the webserver internally it doesn't really apply anyway. –  john Jul 9 '11 at 15:25
add comment

For specific cases, it might work out as a good option to have this pessimistic approach, but other times, this would not work out as you have planned it to be.

  1. The attacker can spoof his ip address to be one amongst your 'list of allowed ip address', and from your 'definition' he would be granted complete access to your services.

  2. The attacker can use various other means to bring down your services. If there are banner or version numbers revealed in your 'HTTP' forbidden response, the attacker would just search for known exploits for those versions, and he could directly try out an exploit.

  3. No attacker can bring down your web application in just one try. The attacker will need to perform a 'Reconnaissance', 'Finger Printing' and vulnerability scans to identify potential weaknesses. By allowing some level of access to outsiders, you can monitor such events and use those data to strengthen your security. This learning period could be extremely beneficial for preventing future attacks.

share|improve this answer
    
:1)What are banner numbers?2)How can I improve this? –  Jim Jul 9 '11 at 6:26
    
@Legolas-- I think there are a number of problems with this answer. 1) Depending on deployment details, spoofing the IP address may not be easy. 2) You are assuming that he is running a version of the web server with a known vulnerability. If so, that is big trouble, and remains big trouble even if he doesn't advertise the version number in the banner. One should try very hard to avoid running web servers with known vulnerabilities. 3) Seems debateable. If we believe that reconnaissance is essential to attacker success, isn't blocking reconnaissance a good thing? –  D.W. Jul 10 '11 at 1:54
add comment

is there anything wrong?

It depends on that HTTP responses you are providing to HTTP requests. I think you are returning 403 Forbidden, but are you returning it in response to all requests?

GET, HEAD, PUT, POST, DELETE, TRACE, CONNECT, OPTIONS

Try sending all these requests from an unauthorized IP address and see what responses you get. If any request returns 401 Unauthorized, the attacker may figure out that you are doing IP address filtering.

an intruder would know that an HTTP server is running but would not be able to access it. Is there a security issue because of this?

Not directly no. Generally speaking, hiding your existance is not a security protection. Hiding your existance is an attempt to prevent being targeted. While being targeted by an attacker is a security problem, many security profesionals believe it is better to focus on the problem of how to defend against an attack, instead of how to prevent an attack from happening.

I believe that if you are a potential target (and what web server isn't?) it is only a matter of time until you are attacked. Not if, but when. Since I believe that you will be attacked, I think effort is better spent preparing a defense. Indeed, attempting to remain invisible may give you a false sense of security and keep you from spending effort on important things like patches and updates. After all, if noone knows I exist I'm safe right?

share|improve this answer
    
Hi.I lost you completely in the first paragraph concerning keys etc. What I do is simply check if the source IP of the HTTP request is in the allowed list or not. 2) I use username and password authentication but if the source IP is not allowed then there is no prompt for credentials.3) If an attacker gets a forbidden how would it be possible to understand that it is due to the IP and spoof it? 4) So what is the improvement you suggest? –  Jim Jul 9 '11 at 12:37
    
Oh, I misunderstood you. Let me make some edits. –  this.josh Jul 9 '11 at 15:03
    
:You are right, I send a 403 Forbidden in response to all requests.Do you think that this gives a hint that IP filtering is happening?Because I am not sure why you say that a 401 could lead an attacker to such a conclusion –  Jim Jul 9 '11 at 19:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.