I don't want to know how... Just how complicated....
我不想知道......有多复杂....
I'm thinking of securing a webservice or 2 based on the incoming client ipaddress of the caller. Is this in any way secure?
我正在考虑基于呼叫者的传入客户端ipaddress来保护web服务或2。这有什么安全吗?
Surely if the IPaddress was being spoofed then the result would have to be sent back to the address that was being spoofed and therefore not reach the spoofer?
当然,如果IP地址被欺骗,那么结果必须被发送回被欺骗的地址,因此无法到达欺骗者?
Update: Ok so from what I can tell.... I should create a Gettoken() method which checks the IPaddress and passes out a cryptographically significant token with a timeout to any valid IP address. This is then required by any other method before any kind of side effect is allowed.
更新:好的,我可以告诉....我应该创建一个Gettoken()方法,它检查IPaddress并传递一个加密有效的令牌,超时到任何有效的IP地址。在允许任何类型的副作用之前,任何其他方法都需要这样做。
Since an Attacker can't (likely) get the token without having a valid IP, he will be unable to validly call any of my "dangerous" webmethods ?
由于攻击者无法(可能)在没有有效IP的情况下获得令牌,他将无法有效地呼叫我的任何“危险”网络方法?
4 个解决方案
#1
3
If you're trying to do something more complex than DDoSing or triggering a security hole, then spoofing is not the answer. What you need is a system that will front for your request, thus hiding the true origin of the request. Since we're talking about HTTP traffic, an Anonymous Proxy will do the trick.
如果你试图做一些比DDoSing更复杂或触发安全漏洞的事情,那么欺骗就不是答案。您需要的是一个系统,它将为您的请求提供支持,从而隐藏请求的真正来源。由于我们讨论的是HTTP流量,因此匿名代理可以解决这个问题。
For the purposes of security you're referring to, it depends on whether or not actions can be taken. If the site is purely informational, then you are safe. If the site allows actions to be performed (e.g. update this, delete that), then consider adding at least password authentication.
出于您所指的安全性的目的,它取决于是否可以采取行动。如果该网站纯粹是信息性的,那么您就是安全的。如果站点允许执行操作(例如,更新此操作,删除它),则考虑至少添加密码身份验证。
Another issue to keep in mind is that anyone controlling routers between your server and the IP address you wish to allow can intercept the packets. That would allow them to have complete two-way spoofed communication without your server realizing it. If you want the information to be truly secure, use HTTPS and an authentication scheme to prevent such interceptions from happening.
要记住的另一个问题是,在您的服务器和您希望允许的IP地址之间控制路由器的任何人都可以拦截数据包。这将使他们能够完成双向欺骗通信而无需服务器实现它。如果您希望信息真正安全,请使用HTTPS和身份验证方案来防止此类拦截发生。
#2
1
Not that hard, just as easy as spoofing your ip address for any other communication http://en.wikipedia.org/wiki/IP_address_spoofing
没那么难,就像欺骗你的IP地址进行任何其他通信一样简单http://en.wikipedia.org/wiki/IP_address_spoofing
But they aren't going to get the responses. The actual IP address they spoofed will.
但他们不会得到回应。他们欺骗的实际IP地址。
#3
1
You're right. If your server response needs to reach the client for a two-way communication to be established then a spoofed IP won't ever receive your response. However, you could suffer a denial-of-service attack from a spoofed IP as computing your response will consume some CPU on the server.
你是对的。如果您的服务器响应需要到达客户端以建立双向通信,则欺骗性IP将不会收到您的响应。但是,您可能会受到欺骗性IP的拒绝服务攻击,因为计算响应会占用服务器上的某些CPU。
#4
0
Part of our web service security is to require clients to use public key / private key encryption (xml digital signatures) to ensure non-repudiation to ensure that only allowed clients can access the service.
我们的Web服务安全性的一部分是要求客户端使用公钥/私钥加密(xml数字签名)来确保不可否认性以确保只有允许的客户端才能访问该服务。
#1
3
If you're trying to do something more complex than DDoSing or triggering a security hole, then spoofing is not the answer. What you need is a system that will front for your request, thus hiding the true origin of the request. Since we're talking about HTTP traffic, an Anonymous Proxy will do the trick.
如果你试图做一些比DDoSing更复杂或触发安全漏洞的事情,那么欺骗就不是答案。您需要的是一个系统,它将为您的请求提供支持,从而隐藏请求的真正来源。由于我们讨论的是HTTP流量,因此匿名代理可以解决这个问题。
For the purposes of security you're referring to, it depends on whether or not actions can be taken. If the site is purely informational, then you are safe. If the site allows actions to be performed (e.g. update this, delete that), then consider adding at least password authentication.
出于您所指的安全性的目的,它取决于是否可以采取行动。如果该网站纯粹是信息性的,那么您就是安全的。如果站点允许执行操作(例如,更新此操作,删除它),则考虑至少添加密码身份验证。
Another issue to keep in mind is that anyone controlling routers between your server and the IP address you wish to allow can intercept the packets. That would allow them to have complete two-way spoofed communication without your server realizing it. If you want the information to be truly secure, use HTTPS and an authentication scheme to prevent such interceptions from happening.
要记住的另一个问题是,在您的服务器和您希望允许的IP地址之间控制路由器的任何人都可以拦截数据包。这将使他们能够完成双向欺骗通信而无需服务器实现它。如果您希望信息真正安全,请使用HTTPS和身份验证方案来防止此类拦截发生。
#2
1
Not that hard, just as easy as spoofing your ip address for any other communication http://en.wikipedia.org/wiki/IP_address_spoofing
没那么难,就像欺骗你的IP地址进行任何其他通信一样简单http://en.wikipedia.org/wiki/IP_address_spoofing
But they aren't going to get the responses. The actual IP address they spoofed will.
但他们不会得到回应。他们欺骗的实际IP地址。
#3
1
You're right. If your server response needs to reach the client for a two-way communication to be established then a spoofed IP won't ever receive your response. However, you could suffer a denial-of-service attack from a spoofed IP as computing your response will consume some CPU on the server.
你是对的。如果您的服务器响应需要到达客户端以建立双向通信,则欺骗性IP将不会收到您的响应。但是,您可能会受到欺骗性IP的拒绝服务攻击,因为计算响应会占用服务器上的某些CPU。
#4
0
Part of our web service security is to require clients to use public key / private key encryption (xml digital signatures) to ensure non-repudiation to ensure that only allowed clients can access the service.
我们的Web服务安全性的一部分是要求客户端使用公钥/私钥加密(xml数字签名)来确保不可否认性以确保只有允许的客户端才能访问该服务。