0

Would it be an acceptable practice, if we were to register a client (individual or company) by associating them with their static IP address to perform some secure action that only authorized clients can do? I looked at the answers stating that restricting clients by their static IP addresses is a good additional protection, and that spoofing an IP address is not a practical attack in two-way communication. I would like to understand how acceptable is it from security perspective to use the client's static IP as the only means to authenticate the client. What would be the specific risks associated with such method?

1

There are several problems with IP-only authentication.

  1. It is not, by itself, secure. A man-in-the-middle attacker can pretend to be the expected host at any IP address, and spoof anybody they want. If you want to prevent that, you'll still need an authenticated and secured channel, such as IPSec or TLS.
  2. An attacker that doesn't need to see response messages can still send requests to the server, if the server supports UDP or protocols that don't require a bi-directional handshake prior to sending any data.
  3. It's brittle. If the IP address ever changes, for any reason, not only will your authorized host lose access, but whoever happens to get the old IP (by luck or by malice) will now be treated as authenticated.

I strongly recommend another approach. Mutual TLS/DTLS is a good option for Internet-based connections where you control, or at least can coordinate, both endpoints. Standard TLS (which only authenticates the server) also works if you have some other way to authenticate the client, such as a password or other pre-shared credential, though then you have to protect against all the standard attacks on authentication systems. Adding IP filtering on top of [D]TLS is generally fine, aside from the brittleness risk

0

I assume that you will register a device's MAC address with a static IP.

This is not secure. Forging MAC address is very easy. You don't need any complicated tools, it can just be done with ifconfig.

  • No, we would allow anyone to connect from any machine (any MAC), it just must be from within that organization's network. We would trust that if a request came from that IP then it must be their authorized personnel, even if they allowed a janitor to do it - that would be their business. I am mostly concerned if someone from the outside would be able to pose as our legit client, e.g. by spoofing their static IP, control a machine in their office, etc. – sun2sirius Sep 15 '18 at 0:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.