4 ms·

Speaking about iptables - is there anything in the wild that allows users make request to web port and I can approve/deny particular requests? For example, 443

by jve 4y ago

Speaking about iptables - is there anything in the wild that allows users make request to web port and I can approve/deny particular requests? For example, 443/TCP is blocked from world. However if someone opens web page, it returns <html><body>Access request from IP xxx.xxx.xxx.xxx has been submitted</body></html> (or maybe a form where you put port number you'd like to access) and from server-side I can somehow see those requests, useragents and accept/deny and just ignore bots. Use-case: Some photoalbum is locked down, accessed by particular IPs/countries/vpn (to reduce or prevent bruteforcing, automated hacking and such) - however I'd like to give access to someone (who doesn't know his IP) by just giving him a domain name. https://photos.example.com https://photos.example.com - yeah, he sees that unfriendly page. After a while I call him and say - try again and poof, next time he opens the page, he penetrates the firewall and gets pictures. The thing is: - VPN is too much of an ask to a person I want to send a link to some data - Country block is very rough filter, just helps to reduce some log traffic from uninteresting countries with loads of bots. - Asking person his IP is very manual: "please open/google up such phrase, send me that address and I'll look up my notes to copy/paste that iptables command and I'll modify it slightly (or add some config entry to .htaccess) to put your IP in and then you'll have access until you reconnect to your mobile network or your ISP gives you new DHCP address and then we'll repeat" "Knockwall" doesn't return much results, eh.

neapolisbeach 4y ago
Port knocking maybe? https://en.m.wikipedia.org/wiki/Port_knocking https://en.m.wikipedia.org/wiki/Port_knocking
iso1631 4y ago
You'd be running a webserver on your firewall. If you want that, just run the webserver and base the response on IP address (have your 401 forbidden page say "forbidden", and allow from 1.2.3.4). Or do a username/password, or do something like openauth to integrate with an identity provider
- jve 4y ago
  Managing IPs manually is same amount of work as managing iptables - see updated question. Yeah, integrating identity providers could work, knowing recipient email addresses and that they use particular services. However that has some complexity/libraries and as with that - vulnerabilities all over again. I just don't want to think/expose attack surface and give possibilities for automated attacks to leak personal data. Or lets say it like that - I trust iptables more than myself integrating identity provider or depending on some library. Actually this is what onedrive/photo galleries etc. does when you share files/folders - generates some magic link that penetrates auth. However it's the same story - I trust complex system (that may have well known vulnerabilities and I was on a vacation) less than iptables.
  - iso1631 4y ago
    Fine, just have your webserver give a 401 to everyone other than the IP address you want to access. If you really want port knocking to get in then have your server listn on port 52485 or whatever and add the IP to the allowed list. I would rather the server doing any processing of the packets be running as a low privilege user than sitting in the kernel.
tuxie_ 4y ago
How would you distinguish his/her IP from the list?
- jve 4y ago
  Country/time/user agent pair won't leave too much ambiguity. I'm talking about persons I know where they live.
zaik 4y ago
TLS client certificates?
- jve 4y ago
  Yeah, try setting up TLS client cert remotely for your grandma and few people... manual iptables is easyer, then :)
  - jrms 4y ago
    It's just one click and hopefully a password away. I use "personal CAs" everywhere, if you share the p12 file via a webserver it's installed by the browser when you click on the link, and share the password over phone or another medium.
- iso1631 4y ago
  I'm a big fan of them, sadly there are a few issues, other than certificate management - safari doesn't handle them well at all in my experience for example
grayfaced 4y ago
Block 8443 on public interface. DNAT your whitelisted IPs to 127.0.0.1:8443 where you're hosting your real page. Put another page on 443 that serves your access request and notifies you. But honestly you should just do the access list in nginx itself.
megous 4y ago
Generate random key, put it into URL, and have some reverse proxy check it against a list to allow the IP on first access.
execveat 4y ago
This isn't what you're asking, but you could just implement Single Sign-On through a social network (Google, Facebook, Twitter).
O__________O 4y ago
Iptables: How to allow only one ip through specific port? https://serverfault.com/questions/146569/iptables-how-to-allow-only-one-ip-through-specific-port https://serverfault.com/questions/146569/iptables-how-to-all... Found that by Googling [iptables whitelist by IP and port]. ___ Another approach is Port Knocking: https://en.m.wikipedia.org/wiki/Port_knocking https://en.m.wikipedia.org/wiki/Port_knocking That said, likely more complex than the solution you’re looking for; also worth mentioning that unless you use the variant called single packet authorization (SPA), where only a single "knock" is needed, consisting of an encrypted packet — the port knocking sequence in theory is observable and reproducible by an attacker.
trabant00 4y ago
You got it a little mixed up. If the web port rejects connections there is no way you cand serve a web page to them, they cannot get to the web server. Th term that you shoud be searching is "port knocking" though I don't know how easy is to do from a mobile phone, it's not exactly a nice user experience. And then you have to decide how long to keep an IP whitelisted and other inconveniences. In the end there's real reasons everybody relies on web auth.
NavinF 4y ago
This is so jank. Why not just text them a password and use HTTP basic auth. It’s built-in on most webservers like nginx.
- hatware 4y ago
  Why are we putting generic pictures behind auth? I get paranoia, but come on. I'd rather open it, and monitor for strange activity/fail2ban to automate banning malicious actors. Don't overthink it. We're sharing pictures, not government secrets.
  - OJFord 4y ago
    You introduced 'generic', as far as I can tell? Maybe they're personal, family, including children, etc. all sorts of things perfectly reasonable not to want 'on the internet' but to share with somebody else specific (by using the internet, sure).
    - hatware 4y ago
      Guess they should use a service like google photos to share them with individuals. Nobody is whitelisting dynamic IP addresses thinking it's secure.
      - yjftsjthsd-h 4y ago
        ... Or, they could use a private server with http simple auth, and be perfectly secure without having to give all their personal photos to Google
- rtev 4y ago
  Right? There are a lot of very complex suggestions for this simple problem. To simplify even more, based on the use case, it would probably be fine to just share an inline user:pass@site.com link. That would avoid even needing the user to fill a basic auth form.
czx4f4bd 4y ago
If you're using a web server like Apache, that functionality is probably built in. Otherwise, you probably want something like Nginx or HAProxy. You can configure rules based on IP and use the logs to check the person's IP. That said IP addresses are generally not static so you would probably be much better off just configuring HTTP basic authentication and giving the password to people to whom you want to grant access. Here's an example if you were to use Nginx as a reverse proxy: https://medium.com/pernod-ricard-tech/adding-basic-authentication-with-nginx-as-a-reverse-proxy-a229f9d12b73 https://medium.com/pernod-ricard-tech/adding-basic-authentic...
somat 4y ago
not what you want at all, but it came to mind. openbsd has it's authpf system, where you ssh in, and the system installs firewall rules. http://man.openbsd.org/authpf http://man.openbsd.org/authpf Something similar probably exists for linux as well. Some days what I really want is shttp, http over ssh.
nullify88 4y ago
I can't think of anything in the wild. You could get far with setting up some webhooks and sending events to IFTTT. Having it self hosted, in the end its a matter of logging some information about users requesting access in to a database, having a UI to display data from said database and having some small automation to add the IP to a whitelist / blacklist.
sofixa 4y ago
Why not use presigned single use URLs? Makes more sense because you're sending an URL anyways
brk 4y ago
Try looking up "port knocking", something like this might be a start: https://blog.odoom.net/port-knocking-http/ https://blog.odoom.net/port-knocking-http/

by jve 4y ago

neapolisbeach 4y ago

Port knocking maybe? https://en.m.wikipedia.org/wiki/Port_knocking https://en.m.wikipedia.org/wiki/Port_knocking

iso1631 4y ago

You'd be running a webserver on your firewall. If you want that, just run the webserver and base the response on IP address (have your 401 forbidden page say "forbidden", and allow from 1.2.3.4). Or do a username/password, or do something like openauth to integrate with an identity provider

jve 4y ago
Managing IPs manually is same amount of work as managing iptables - see updated question. Yeah, integrating identity providers could work, knowing recipient email addresses and that they use particular services. However that has some complexity/libraries and as with that - vulnerabilities all over again. I just don't want to think/expose attack surface and give possibilities for automated attacks to leak personal data. Or lets say it like that - I trust iptables more than myself integrating identity provider or depending on some library. Actually this is what onedrive/photo galleries etc. does when you share files/folders - generates some magic link that penetrates auth. However it's the same story - I trust complex system (that may have well known vulnerabilities and I was on a vacation) less than iptables.
- iso1631 4y ago
  Fine, just have your webserver give a 401 to everyone other than the IP address you want to access. If you really want port knocking to get in then have your server listn on port 52485 or whatever and add the IP to the allowed list. I would rather the server doing any processing of the packets be running as a low privilege user than sitting in the kernel.

tuxie_ 4y ago

How would you distinguish his/her IP from the list?

jve 4y ago
Country/time/user agent pair won't leave too much ambiguity. I'm talking about persons I know where they live.

zaik 4y ago

TLS client certificates?

jve 4y ago
Yeah, try setting up TLS client cert remotely for your grandma and few people... manual iptables is easyer, then :)
- jrms 4y ago
  It's just one click and hopefully a password away. I use "personal CAs" everywhere, if you share the p12 file via a webserver it's installed by the browser when you click on the link, and share the password over phone or another medium.
iso1631 4y ago
I'm a big fan of them, sadly there are a few issues, other than certificate management - safari doesn't handle them well at all in my experience for example

grayfaced 4y ago

Block 8443 on public interface. DNAT your whitelisted IPs to 127.0.0.1:8443 where you're hosting your real page. Put another page on 443 that serves your access request and notifies you. But honestly you should just do the access list in nginx itself.

megous 4y ago

Generate random key, put it into URL, and have some reverse proxy check it against a list to allow the IP on first access.

execveat 4y ago

This isn't what you're asking, but you could just implement Single Sign-On through a social network (Google, Facebook, Twitter).

O__________O 4y ago

Iptables: How to allow only one ip through specific port? https://serverfault.com/questions/146569/iptables-how-to-allow-only-one-ip-through-specific-port https://serverfault.com/questions/146569/iptables-how-to-all... Found that by Googling [iptables whitelist by IP and port]. ___ Another approach is Port Knocking: https://en.m.wikipedia.org/wiki/Port_knocking https://en.m.wikipedia.org/wiki/Port_knocking That said, likely more complex than the solution you’re looking for; also worth mentioning that unless you use the variant called single packet authorization (SPA), where only a single "knock" is needed, consisting of an encrypted packet — the port knocking sequence in theory is observable and reproducible by an attacker.

trabant00 4y ago

You got it a little mixed up. If the web port rejects connections there is no way you cand serve a web page to them, they cannot get to the web server. Th term that you shoud be searching is "port knocking" though I don't know how easy is to do from a mobile phone, it's not exactly a nice user experience. And then you have to decide how long to keep an IP whitelisted and other inconveniences. In the end there's real reasons everybody relies on web auth.

NavinF 4y ago

This is so jank. Why not just text them a password and use HTTP basic auth. It’s built-in on most webservers like nginx.

hatware 4y ago
Why are we putting generic pictures behind auth? I get paranoia, but come on. I'd rather open it, and monitor for strange activity/fail2ban to automate banning malicious actors. Don't overthink it. We're sharing pictures, not government secrets.
- OJFord 4y ago
  You introduced 'generic', as far as I can tell? Maybe they're personal, family, including children, etc. all sorts of things perfectly reasonable not to want 'on the internet' but to share with somebody else specific (by using the internet, sure).
  - hatware 4y ago
    Guess they should use a service like google photos to share them with individuals. Nobody is whitelisting dynamic IP addresses thinking it's secure.
    - yjftsjthsd-h 4y ago
      ... Or, they could use a private server with http simple auth, and be perfectly secure without having to give all their personal photos to Google
rtev 4y ago
Right? There are a lot of very complex suggestions for this simple problem. To simplify even more, based on the use case, it would probably be fine to just share an inline user:pass@site.com link. That would avoid even needing the user to fill a basic auth form.

czx4f4bd 4y ago

If you're using a web server like Apache, that functionality is probably built in. Otherwise, you probably want something like Nginx or HAProxy. You can configure rules based on IP and use the logs to check the person's IP. That said IP addresses are generally not static so you would probably be much better off just configuring HTTP basic authentication and giving the password to people to whom you want to grant access. Here's an example if you were to use Nginx as a reverse proxy: https://medium.com/pernod-ricard-tech/adding-basic-authentication-with-nginx-as-a-reverse-proxy-a229f9d12b73 https://medium.com/pernod-ricard-tech/adding-basic-authentic...

somat 4y ago

not what you want at all, but it came to mind. openbsd has it's authpf system, where you ssh in, and the system installs firewall rules. http://man.openbsd.org/authpf http://man.openbsd.org/authpf Something similar probably exists for linux as well. Some days what I really want is shttp, http over ssh.

nullify88 4y ago

I can't think of anything in the wild. You could get far with setting up some webhooks and sending events to IFTTT. Having it self hosted, in the end its a matter of logging some information about users requesting access in to a database, having a UI to display data from said database and having some small automation to add the IP to a whitelist / blacklist.

sofixa 4y ago

Why not use presigned single use URLs? Makes more sense because you're sending an URL anyways

brk 4y ago

Try looking up "port knocking", something like this might be a start: https://blog.odoom.net/port-knocking-http/ https://blog.odoom.net/port-knocking-http/