1

I am getting a web application designed for the office staff to use in order to automate a process. There are multiple office locations and hence several computers in multiple location. Is it possible to restrict access to the web application to those computers only?

1

Yes.

And there are lots of different ways to do so. You didn't say how sensitive/valuable the asset you are protecting is - nor how secure the network is; this has some bearing on the level of protection you need to provide for the application.

An obvious solution is to block access by IP address either in the webserver config, the application or on the firewall between the server and network. However this is only going to be effective within a well managed, highly secured network. Spoofing an IP address is easy within a LAN.

But you say that you have multiple locations (but did not specify how the sites are connected). So this is unlikely to be workable in your case.

A better solution would be to use clent certificates. These cannot be spoofed (if configured correctly) but can be copied (it's just a file) unless implemented in a hardware module or at least implemented in a seperated privilege runtime with appropriate permissions.

There are other aproaches, such as one time passwords stored in a suitably secure location or running a VPN on top of your LAN (e.g. ssh, ipsec or openvpn).

None of these should be considered a substitute for user authentication.

  • Instead of IP address based filtering, it might make more sense if he used MAC based filtering. After all, he wants specific computers to access his web-app. :) – theabhinavdas Aug 11 '16 at 23:39
  • 2
    @0x23212f: MAC addresses are only exposed on a LAN. If they're using a LAN across networks (presumably via VPN) then you don't have to do any filtering at all beyond making the web app only accessible to the local network.... well, unless you want to restrict which computers within that local network have access. MAC address spoofing is possible, though. – CBHacking Aug 12 '16 at 0:54
1

Yes this is possible and there are few ways of doing this and depending on the requirement of security level you can combine two ways of doing this.

You want to specific computers to be connected so that you can use. MAC address filtering and use Client Side Certificates on the computers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.