0

I have transmission-daemon setup with RPC enabled using a whitelist. The whitelist contains only 127.0.0.1 and my virtual private network range of IP addresses. I connect most of my devices through an openvpn server, and so I am wondering why I would need to enable standard auth (user/password) for services that are only accessible internally/by me. I know that this is only as secure as safe I keep my VPN/ssh keys. I am the only one (besides the hosting company) that has access to this server, so I can't really find a reason to have a username/password which gives me more things to remember and makes the process of using these services generally more cumbersome. Thoughts?

1

By having mo auth you are opening up more attack vectors. Couple of examples I can thin of:

  • Network is compromised and the attacker manages to get one of the IPs from VPN range
  • VPN is compromised and attacker gets access to the network that way
  • Another service on the server is compromised and attacker makes the requests from server (127.0.0.1)

All these attack vectors would give the attacker full access to the service you have described. Having auth on the service would fix that.

  • 1
    It's also a lot easier to build these things in at the start than later. – symcbean Dec 22 '13 at 21:15
  • +1. It doesn't even need anything to be compromised though. A CSRF on the intranet can usually be exploited by a malicious page on the internet, so unless the intranet is air-gapped, you'll need to password protect your internal webpages. – Matt Dec 23 '13 at 0:22
  • 1
    CSRF is a different issue. having AUTH would not help. You would need a csrf token to protect from that. – valentinas Dec 23 '13 at 3:40
0

Your network or VPN does not even have to be compromised. Any external website could over a client with has access to that server request a url. A common attack scenario is i.e. calling some services on "fritz.box" from a regular website, which might have some xss vulnerabilities. Usually fritz.box is not accessible from outside, but so many internal networks are using that hostname, so you can gain very easy access to an internal host, through the compromised website a client has visited.

  • Again, auth will not protect from that. – valentinas Dec 23 '13 at 19:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.