1

My goal is to build a system (PHP + MySQL) where a user will have access to particular data only when logged in locally (from one of the office computers with a local IP), and to all the non-sensitive data when logged in both from a local network and from the outside (regular web host).

I already have the software running on a web server (Centos 5, PHP + MySQL), but I can't store on it any sensitive information, e.g. costs and other financial data. And I have a private network in my office where I can build any server configuration I need (Windows or Linux based server - any configuration is accepted). What I need is:

  • if a user has an IP different from a predefined range, limit the access to only non-sensitive fields of the data;
  • if a user has in IP from a white-list (local network), grant the access to all the data, including the sensitive data;
  • if a user changes something from inside a local network, the changes will be visible on the outside immediately;
  • if a user changes something from the outside (on a public server), the changes will also be visible on the inside immediately.

Currently I don't know whether to create two separate systems and somehow manage to synchronize data between them, or to store all the data locally and in the scripts check user's permissions, or to do something different. What I do know is that the financial data cannot be stored on the outside and cannot be accessed directly from the outside in any way.

I'll be glad for any the help with this problem, even with general direction that I may research.

  • Are you using Apache? – Bubble Hacker May 29 '16 at 16:06
  • On the outside server yes, inside the local network it may be apache or any other server – Yury Fedorov May 29 '16 at 16:08
3

This is the job of a host-based firewall. While IP based rules are so integral to the system that the built~in GNU/Linux Firewall is named Iptables and the basic slement of a firewall is a list of rules (called a chain) that could easily handle whatever packets of the type you describe that aren't handled back at the hardware router/firewall ip layer, I have to wonder if someone who has so little knowledge of computer security that I have to tell him this is up to the task. Security IS HARD. It requires a lot of skill and very up-to-date knowledge.

You really have two choices. You can contract this out to someone who is an expert in secure firewalls to script rules for you, or you can try to figure it out yourself. I warn you modern computer security on a network is no trivial task. Along with my direst warning against putting people's personal information at risk through insecure network exposure, I offer you a link to the basics of iptables and a book recommendation. Good luck!

http://www.tecmint.com/basic-guide-on-iptables-linux-firewall-tips-commands/

Prentice Hall Unix and Linux System Administration Handbook - Homepage I especially recommend you read Section Two - Networking and focus on Chapters 14-17 and 22. This will just give you an overview, not miraculously make you an expert.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.