I have a bunch of users that are all behind the same VPN. My website (outside of the VPN) is supposed to be only accessible for these users. There is no guest for this VPN. My website is https only. Is it acceptable in this case to rely on IP as an authentication mecanism ?
The question asked is "Is it acceptable in this case to rely on IP as an authentication [mechanism]?"
The short answer is: It depends.
Let's start with a definition of authentication. Merriam-Webster defines authentication as
": an act, process, or method of showing something (such as an identity, a piece of art, or a financial transaction) to be real, true, or genuine"
So the questions to be asked in answering this question:
- What is the information classification involved? This is the basis of 'acceptability' for any security mechanism.
- How strong and reliable are the authentication and authorization mechanisms of the VPN in question?
- How strong and reliable are the mechanisms in place ensuring authentic IP address usage?
- What are you authenticating: the workstation; the individual users?
- Is there a direct verifiable relationship between any given IP address and any given individual user?
Your individual answers to the questions above will answer your question for you.
At a high level, and without many of the details, it seems that we can say that if the classification of the information being accessed requires authentication of individual persons, then it appears that the use of an IP address with limited-to-no verifiable direct relationship to any given individual would not be acceptable.
Is it acceptable in this case to rely on IP as an authentication mechanism ?
Yes, because performing an attack that will spoof a connection requires the attacker to be placed in a very very specific location along the path of communication. So you are safe from that.
The above holds, assuming you don't have any confidential data and you just want to allow connections from a specific IP address to access your shopping list or example.
Some other security forum contributors (see comments) have kindly left their thoughts about the initial post (first post suggested to use username-password as well as whitelisting, because whitelisting is not an authentication mechanism):
- There is no need for any other form of authentication and MFA would probably be a complete overkill.
- IP-whitelisting is more than enough for your apparent needs.
- You obviously have no need for auditing.
- From your question, we know that you don't care about actual authentication or the associated technicalities. Hence, whitelisting is the optimal solution
Yes and No.
Yes - because you will be safe from non-targeted external attacks (if your website does have proper settings for not leaking data on denied requests, etc, but that was not the question). It's almost impossible to spoof IP from outside the perimeter (not being man in the middle), however still possible, but that would require quite a lot of resources and time (which means you are targeted)
No - because you still need to apply additional authentication mechanisms in order to implement defense in depth. This model are susceptible for MiTM attacks, and if you are targeted, after a bit of enumeration and reconnaissance, attacker will surely try to infiltrate users, if that will be easier.
Your further actions should depend on calculating the attack vector, impact of exploitation, ease of exploitation and frequency of attack. If that is some obscure website for internal use like file sharing or some workplace (ensemble, sharepoint, etc), chances are that you will not be picked a target. If the files in this workplace have sensitive data that can put at risk your whole business and\or reputation, then even if you will be hacked once in 10 years - then you will lose everything. Consider this when you will rethink your defence techniques. Best of everything!
I wouldn't because then you're relying on outside network infrastructure for your security.
I'd recommend creating an internal proxy server that injects credentials.
In reality, this will probably work just fine, but if it were something highly sensitive, I'd go with my previous recommendation, it's pretty easy to setup.
You should use IP address for authorization, but not for authentication. Authentication is who you are, authorization is what you are allowed to do.
If you use IP address for access control, you don't have authentication. You don't know who used what, and any audit trail is useless. But it works for simpler cases, like a read-only documentation site for internal use.
IP Spoofing is not something you should worry about. With egress filtering and random TCP Sequence Number on connection establishment, it's very difficult to pull off an attack using it. Sending data using spoofing is very difficult, but read data is impossible by definition. IP Spoofing means you are forging your address, so the response will go to the spoofed address, not you.
If you are using HTTPS on the site, and don't want to have login and password, you can use HTTPS Client Authentication. Most webservers support that.