3

Usually it is advised, when one wants to secure an application, to "provide" as little information, or better yet, no information at all to unauthorized (possibly malicious) users. I'm thinking of information like OS, app version, etc.

My question is the following:
I have a web application that allows access only from specific IPs, the rest of the world gets an HTTP Forbidden response. I was wondering, in the context of security mentioned above, is there anything wrong? I mean I guess an intruder would know that an HTTP server is running but would not be able to access it.

Is there a security issue because of this? Could it be improved somehow?
UPDATE:
I am also using authentication via username and password but if the source IP is not in the allowed list they do not get a username/password prompt page. Just forbidden

Improve this question
1
  • What error code is returned when a unallowed IP address makes a request?
    – this.josh
    Jul 9, 2011 at 15:13

4 Answers 4

Reset to default
5

If your web server is only serving specific IPs, it's probably a better idea to only allow those IPs in your firewall.

Improve this answer
2
  • The spoofing of IP addresses as mentioned by Legolas, isn't it an issue in firewall as well?
    – Jim
    Jul 9, 2011 at 6:27
  • @Jim of course it is, but you said that this is your preferred method of authentication, so you probably understands that spoofing is a risk. But IP spoofing is not an easy thing to do in the internet, so if you don't use the webserver internally it doesn't really apply anyway.
    – john
    Jul 9, 2011 at 15:25
5

is there anything wrong?

It depends on that HTTP responses you are providing to HTTP requests. I think you are returning 403 Forbidden, but are you returning it in response to all requests?

GET, HEAD, PUT, POST, DELETE, TRACE, CONNECT, OPTIONS

Try sending all these requests from an unauthorized IP address and see what responses you get. If any request returns 401 Unauthorized, the attacker may figure out that you are doing IP address filtering.

an intruder would know that an HTTP server is running but would not be able to access it. Is there a security issue because of this?

Not directly no. Generally speaking, hiding your existance is not a security protection. Hiding your existance is an attempt to prevent being targeted. While being targeted by an attacker is a security problem, many security profesionals believe it is better to focus on the problem of how to defend against an attack, instead of how to prevent an attack from happening.

I believe that if you are a potential target (and what web server isn't?) it is only a matter of time until you are attacked. Not if, but when. Since I believe that you will be attacked, I think effort is better spent preparing a defense. Indeed, attempting to remain invisible may give you a false sense of security and keep you from spending effort on important things like patches and updates. After all, if noone knows I exist I'm safe right?

Improve this answer
3
  • Hi.I lost you completely in the first paragraph concerning keys etc. What I do is simply check if the source IP of the HTTP request is in the allowed list or not. 2) I use username and password authentication but if the source IP is not allowed then there is no prompt for credentials.3) If an attacker gets a forbidden how would it be possible to understand that it is due to the IP and spoof it? 4) So what is the improvement you suggest?
    – Jim
    Jul 9, 2011 at 12:37
  • Oh, I misunderstood you. Let me make some edits.
    – this.josh
    Jul 9, 2011 at 15:03
  • :You are right, I send a 403 Forbidden in response to all requests.Do you think that this gives a hint that IP filtering is happening?Because I am not sure why you say that a 401 could lead an attacker to such a conclusion
    – Jim
    Jul 9, 2011 at 19:44
1

For specific cases, it might work out as a good option to have this pessimistic approach, but other times, this would not work out as you have planned it to be.

  1. The attacker can spoof his ip address to be one amongst your 'list of allowed ip address', and from your 'definition' he would be granted complete access to your services.

  2. The attacker can use various other means to bring down your services. If there are banner or version numbers revealed in your 'HTTP' forbidden response, the attacker would just search for known exploits for those versions, and he could directly try out an exploit.

  3. No attacker can bring down your web application in just one try. The attacker will need to perform a 'Reconnaissance', 'Finger Printing' and vulnerability scans to identify potential weaknesses. By allowing some level of access to outsiders, you can monitor such events and use those data to strengthen your security. This learning period could be extremely beneficial for preventing future attacks.

Improve this answer
2
  • :1)What are banner numbers?2)How can I improve this?
    – Jim
    Jul 9, 2011 at 6:26
  • @Legolas-- I think there are a number of problems with this answer. 1) Depending on deployment details, spoofing the IP address may not be easy. 2) You are assuming that he is running a version of the web server with a known vulnerability. If so, that is big trouble, and remains big trouble even if he doesn't advertise the version number in the banner. One should try very hard to avoid running web servers with known vulnerabilities. 3) Seems debateable. If we believe that reconnaissance is essential to attacker success, isn't blocking reconnaissance a good thing?
    – D.W.
    Jul 10, 2011 at 1:54
0

You could be sneaky and serve different content to "approved" and "unapproved" clients.

See https://serverfault.com/questions/336586/apache-client-ip-based-documentroot

Unapproved ip's could be served a honeytrap, or just a mockup "How is this for our new frontpage?" with lorem ipsum and placeholde.it images.

Armoured doors and big padlocks might scare some away, but 401/403 and "Trespassers will be shot"-signs might just tease some to try.

Just serving innocent looking content and "404 not found" will fool many script kiddies, and will not give more information to the determined hacker.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .