I have transmission-daemon setup with RPC enabled using a whitelist. The whitelist contains only 127.0.0.1 and my virtual private network range of IP addresses. I connect most of my devices through an openvpn server, and so I am wondering why I would need to enable standard auth (user/password) for services that are only accessible internally/by me. I know that this is only as secure as safe I keep my VPN/ssh keys. I am the only one (besides the hosting company) that has access to this server, so I can't really find a reason to have a username/password which gives me more things to remember and makes the process of using these services generally more cumbersome. Thoughts?
By having mo auth you are opening up more attack vectors. Couple of examples I can thin of:
- Network is compromised and the attacker manages to get one of the IPs from VPN range
- VPN is compromised and attacker gets access to the network that way
- Another service on the server is compromised and attacker makes the requests from server (127.0.0.1)
All these attack vectors would give the attacker full access to the service you have described. Having auth on the service would fix that.
Your network or VPN does not even have to be compromised. Any external website could over a client with has access to that server request a url. A common attack scenario is i.e. calling some services on "fritz.box" from a regular website, which might have some xss vulnerabilities. Usually fritz.box is not accessible from outside, but so many internal networks are using that hostname, so you can gain very easy access to an internal host, through the compromised website a client has visited.