I have a bunch of users that are all behind the same VPN. My website (outside of the VPN) is supposed to be only accessible for these users. There is no guest for this VPN. My website is https only. Is it acceptable in this case to rely on IP as an authentication mecanism ?

  • @ThoriumBR Can you please point me to a resource where it explains why IP spoofing has become more difficult ? – sam.zap Jan 30 at 17:56
  • @P.Soutzikevich the users are not using anything personal, just some company info. The IP address of the VPN is static and won't change either. Under those circumstances, can you still find ways in which it would be bad ? – sam.zap Jan 30 at 17:58
  • Yes, exactly what you added in bold. So in that case, is it acceptable (it's not possible to rely on IP spoofing for an attacker, since I'm using https, right?) ? – sam.zap Jan 30 at 17:59
  • @P.Soutzikevich IP spoofing TCP/IP requests (and therefore HTTP/s) is in fact impossible unless you have yourself properly position as a MitM. You can certainly send a spoofed IP packet, but establishing a TCP/IP connection requires a proper handshake. Therefore unless the attacker is in a position to intercept and reply to the response from the server, it can't be done. – Conor Mancone Jan 30 at 19:28
  • Only you can decide whether or not IP whitelisting is sufficient. Restricting access to a particular VPN is, in fact, a common security step. This won't protect you from people who break into the VPN or (potentially) malware running on the machine of anyone connected to the VPN. However, depending on what your site hosts, this may not matter. That is why this depends on you. The question isn't "is this secure?" because nothing is ever secure. The only question is whether or not this is secure enough for you. – Conor Mancone Jan 30 at 19:32

The question asked is "Is it acceptable in this case to rely on IP as an authentication [mechanism]?"

The short answer is: It depends.

Let's start with a definition of authentication. Merriam-Webster defines authentication as

": an act, process, or method of showing something (such as an identity, a piece of art, or a financial transaction) to be real, true, or genuine"

So the questions to be asked in answering this question:

  1. What is the information classification involved? This is the basis of 'acceptability' for any security mechanism.
  2. How strong and reliable are the authentication and authorization mechanisms of the VPN in question?
  3. How strong and reliable are the mechanisms in place ensuring authentic IP address usage?
  4. What are you authenticating: the workstation; the individual users?
  5. Is there a direct verifiable relationship between any given IP address and any given individual user?

Your individual answers to the questions above will answer your question for you.

At a high level, and without many of the details, it seems that we can say that if the classification of the information being accessed requires authentication of individual persons, then it appears that the use of an IP address with limited-to-no verifiable direct relationship to any given individual would not be acceptable.

|improve this answer|||||

Is it acceptable in this case to rely on IP as an authentication mechanism ?

Yes, because performing an attack that will spoof a connection requires the attacker to be placed in a very very specific location along the path of communication. So you are safe from that.

The above holds, assuming you don't have any confidential data and you just want to allow connections from a specific IP address to access your shopping list or example.

Some other security forum contributors (see comments) have kindly left their thoughts about the initial post (first post suggested to use username-password as well as whitelisting, because whitelisting is not an authentication mechanism):

  • There is no need for any other form of authentication and MFA would probably be a complete overkill.
  • IP-whitelisting is more than enough for your apparent needs.
  • You obviously have no need for auditing.
  • From your question, we know that you don't care about actual authentication or the associated technicalities. Hence, whitelisting is the optimal solution
|improve this answer|||||
  • Whitelisting static IPs can provide a level of authentication for the machine. It's done all the time on firewalls and permitting admin access, etc. And the MitM attack that spoofs needs to be in a very, very specific location in the network path (either right before the victim or the server) so not just "somewhere" along the path. Depending on the location of the VPN ingress and egress and the network connection, it could be impossible to spoof the IP. – schroeder Jan 30 at 19:52
  • @schroeder Can whitelisting be considered a form of authentication ? NO. Can it be a kind of "workaround" for performing authentication-related tasks? YES. I never said the MiTM attack can be anywhere along the path. Somewhere means in some place, it doesn't mean in any place. – Soutzikevich Jan 30 at 20:00
  • I said "a level of authentication". Even MFA allows for "somewhere you are" as a factor. And "somewhere" suggests an unspecified place, not "anywhere", when it would actually need to be very specific. Slow down, you are getting very agitated very quickly and taking things personally. – schroeder Jan 30 at 20:03
  • I think this answer is fine, given the likely context. It doesn't sound like this is a "I'm interested in a general, theoretical answer" like conor suggests, but rather it sounds like the user is asking what the risks are in IP spoofing. They're pretty low, as this answer points out. IMHO an IP based security control can be perfectly fine as long as what you're protecting isn't too highly valuable. – Steve Sether Jan 30 at 21:52
  • @P.Soutzikevich my reaction was not to your final edit, but to your initial one – schroeder Jan 31 at 7:32

Yes and No.

Yes - because you will be safe from non-targeted external attacks (if your website does have proper settings for not leaking data on denied requests, etc, but that was not the question). It's almost impossible to spoof IP from outside the perimeter (not being man in the middle), however still possible, but that would require quite a lot of resources and time (which means you are targeted)

No - because you still need to apply additional authentication mechanisms in order to implement defense in depth. This model are susceptible for MiTM attacks, and if you are targeted, after a bit of enumeration and reconnaissance, attacker will surely try to infiltrate users, if that will be easier.

Your further actions should depend on calculating the attack vector, impact of exploitation, ease of exploitation and frequency of attack. If that is some obscure website for internal use like file sharing or some workplace (ensemble, sharepoint, etc), chances are that you will not be picked a target. If the files in this workplace have sensitive data that can put at risk your whole business and\or reputation, then even if you will be hacked once in 10 years - then you will lose everything. Consider this when you will rethink your defence techniques. Best of everything!

|improve this answer|||||

I wouldn't because then you're relying on outside network infrastructure for your security.

I'd recommend creating an internal proxy server that injects credentials.

In reality, this will probably work just fine, but if it were something highly sensitive, I'd go with my previous recommendation, it's pretty easy to setup.

|improve this answer|||||

You should use IP address for authorization, but not for authentication. Authentication is who you are, authorization is what you are allowed to do.

If you use IP address for access control, you don't have authentication. You don't know who used what, and any audit trail is useless. But it works for simpler cases, like a read-only documentation site for internal use.

IP Spoofing is not something you should worry about. With egress filtering and random TCP Sequence Number on connection establishment, it's very difficult to pull off an attack using it. Sending data using spoofing is very difficult, but read data is impossible by definition. IP Spoofing means you are forging your address, so the response will go to the spoofed address, not you.

If you are using HTTPS on the site, and don't want to have login and password, you can use HTTPS Client Authentication. Most webservers support that.

|improve this answer|||||
  • 1
    Authentication is proving who you are, identification is who you are. – elsadek Jan 30 at 22:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.