3

How do you restrict user access to a corporate web site to a particular machine ?

including the following conditions :

  • Each user is meant to use his credentials ONLY from the assigned machine.
  • The website is deployed on the internet.
  • Static IP's are not affordable due to huge number of users.
  • The corporate web site has confidential information which should not accessible to users outside their designated cubicles.
|improve this question
2

On the internet, as in offsite?

If it's on the internet, I'd look into setting up a VPN tunnel so requests are made unNATed through the VPN tunnel and the server can detect individual machines (and MACs).

Probably the best answer I can come up with to get what you want (though both IPs and MACs are spoofable) in terms of setup.

IMO: Best way would be to write a desktop application that calls a web service on the back end of that server, that way you can generate certificates based off of the hardware and bind it to the account (cert wont be valid on another computer). You could slim this down into some kind of one-use log in token or something.

|improve this answer
  • Ideally, would these certicates be stored on the server and validated, or would they be generated for each login session ? – Question Guy Jan 19 '12 at 19:06
  • In my mind: they would be validated by the local service to match the hardware, then queried on the web service for one valid log in, move the certificate to another PC with the service installed and the service fails verification (new hardware), install the service somewhere else and it's missing the cert so it doesn't match what has been authorized. Of course just a quick brainstorm, I bet there are a ton of improvements that could be made on this idea. – StrangeWill Jan 19 '12 at 19:09
  • Thank you for providing your opinion. Btw, are there any similar off-the shelf products in the market ? – Question Guy Jan 19 '12 at 19:15
  • I can't think of anything "off the shelf", this is typically something a company would custom code I believe. – StrangeWill Jan 23 '12 at 18:07
2

You would typically install a client certificate on each user's machine and require it for access to the web site.

This of course requires the machine's OS be locked down heavily to ensure that the client certificate cannot easily be moved.

If this is not possible, an alternative would be to use a hardware dongle that is physically attached to the machine in a non-removeable fashion. (And of course you'd have to physically attach the machine to the cubicle.)

|improve this answer
  • What if the user bypasses browser export restrictions and uses the certifcate from another machine ? – Question Guy Jan 19 '12 at 17:59
  • 1
    @QuestionGuy If your users are likely to do that, I think you have a different problem which is beyond the scope of this site. – Iszi Jan 19 '12 at 18:04
  • 1
    I had assumed you had "normal" users, since you don't mention their characteristics in the question. Updated to assume you have knowledgeable users actively attempting to circumvent your technical controls who are not deterred by policy. – Graham Hill Jan 19 '12 at 18:42
  • @GrahamHill - Thank you for expanding your viewpoint. – Question Guy Jan 19 '12 at 18:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.