Comment by jve | Hacker News Reader

Comment by jve | Hacker News Reader

Speaking about iptables - is there anything in the wild that allows users make request to web port and I can approve/deny particular requests?

For example, 443/TCP is blocked from world. However if someone opens web page, it returns <html><body>Access request from IP xxx.xxx.xxx.xxx has been submitted</body></html> (or maybe a form where you put port number you'd like to access) and from server-side I can somehow see those requests, useragents and accept/deny and just ignore bots.

Use-case: Some photoalbum is locked down, accessed by particular IPs/countries/vpn (to reduce or prevent bruteforcing, automated hacking and such) - however I'd like to give access to someone (who doesn't know his IP) by just giving him a domain name. https://photos.example.com - yeah, he sees that unfriendly page. After a while I call him and say - try again and poof, next time he opens the page, he penetrates the firewall and gets pictures.

The thing is:

- VPN is too much of an ask to a person I want to send a link to some data

- Country block is very rough filter, just helps to reduce some log traffic from uninteresting countries with loads of bots.

- Asking person his IP is very manual: "please open/google up such phrase, send me that address and I'll look up my notes to copy/paste that iptables command and I'll modify it slightly (or add some config entry to .htaccess) to put your IP in and then you'll have access until you reconnect to your mobile network or your ISP gives you new DHCP address and then we'll repeat"

"Knockwall" doesn't return much results, eh.

This is so jank. Why not just text them a password and use HTTP basic auth. It’s built-in on most webservers like nginx.

Why are we putting generic pictures behind auth?

I get paranoia, but come on. I'd rather open it, and monitor for strange activity/fail2ban to automate banning malicious actors.

Don't overthink it. We're sharing pictures, not government secrets.

You introduced 'generic', as far as I can tell? Maybe they're personal, family, including children, etc. all sorts of things perfectly reasonable not to want 'on the internet' but to share with somebody else specific (by using the internet, sure).

Guess they should use a service like google photos to share them with individuals. Nobody is whitelisting dynamic IP addresses thinking it's secure.

... Or, they could use a private server with http simple auth, and be perfectly secure without having to give all their personal photos to Google

Right? There are a lot of very complex suggestions for this simple problem.

To simplify even more, based on the use case, it would probably be fine to just share an inline user:pass@site.com link. That would avoid even needing the user to fill a basic auth form.

If you're using a web server like Apache, that functionality is probably built in. Otherwise, you probably want something like Nginx or HAProxy. You can configure rules based on IP and use the logs to check the person's IP.

That said IP addresses are generally not static so you would probably be much better off just configuring HTTP basic authentication and giving the password to people to whom you want to grant access. Here's an example if you were to use Nginx as a reverse proxy: https://medium.com/pernod-ricard-tech/adding-basic-authentic...

Generate random key, put it into URL, and have some reverse proxy check it against a list to allow the IP on first access.

Why not use presigned single use URLs? Makes more sense because you're sending an URL anyways

You got it a little mixed up. If the web port rejects connections there is no way you cand serve a web page to them, they cannot get to the web server.

Th term that you shoud be searching is "port knocking" though I don't know how easy is to do from a mobile phone, it's not exactly a nice user experience. And then you have to decide how long to keep an IP whitelisted and other inconveniences.

In the end there's real reasons everybody relies on web auth.

Iptables: How to allow only one ip through specific port?

https://serverfault.com/questions/146569/iptables-how-to-all...

Found that by Googling [iptables whitelist by IP and port]. ___

Another approach is Port Knocking:

https://en.m.wikipedia.org/wiki/Port_knocking

That said, likely more complex than the solution you’re looking for; also worth mentioning that unless you use the variant called single packet authorization (SPA), where only a single "knock" is needed, consisting of an encrypted packet — the port knocking sequence in theory is observable and reproducible by an attacker.

You'd be running a webserver on your firewall.

If you want that, just run the webserver and base the response on IP address (have your 401 forbidden page say "forbidden", and allow from 1.2.3.4). Or do a username/password, or do something like openauth to integrate with an identity provider

Managing IPs manually is same amount of work as managing iptables - see updated question.

Yeah, integrating identity providers could work, knowing recipient email addresses and that they use particular services. However that has some complexity/libraries and as with that - vulnerabilities all over again. I just don't want to think/expose attack surface and give possibilities for automated attacks to leak personal data.

Or lets say it like that - I trust iptables more than myself integrating identity provider or depending on some library.

Actually this is what onedrive/photo galleries etc. does when you share files/folders - generates some magic link that penetrates auth. However it's the same story - I trust complex system (that may have well known vulnerabilities and I was on a vacation) less than iptables.

Fine, just have your webserver give a 401 to everyone other than the IP address you want to access. If you really want port knocking to get in then have your server listn on port 52485 or whatever and add the IP to the allowed list.

I would rather the server doing any processing of the packets be running as a low privilege user than sitting in the kernel.

Block 8443 on public interface. DNAT your whitelisted IPs to 127.0.0.1:8443 where you're hosting your real page. Put another page on 443 that serves your access request and notifies you.

But honestly you should just do the access list in nginx itself.

Port knocking maybe?

https://en.m.wikipedia.org/wiki/Port_knocking

This isn't what you're asking, but you could just implement Single Sign-On through a social network (Google, Facebook, Twitter).

I can't think of anything in the wild. You could get far with setting up some webhooks and sending events to IFTTT.

Having it self hosted, in the end its a matter of logging some information about users requesting access in to a database, having a UI to display data from said database and having some small automation to add the IP to a whitelist / blacklist.

not what you want at all, but it came to mind. openbsd has it's authpf system, where you ssh in, and the system installs firewall rules.

http://man.openbsd.org/authpf

Something similar probably exists for linux as well.

Some days what I really want is shttp, http over ssh.

Try looking up "port knocking", something like this might be a start:

https://blog.odoom.net/port-knocking-http/

TLS client certificates?

Yeah, try setting up TLS client cert remotely for your grandma and few people... manual iptables is easyer, then :)

It's just one click and hopefully a password away. I use "personal CAs" everywhere, if you share the p12 file via a webserver it's installed by the browser when you click on the link, and share the password over phone or another medium.

I'm a big fan of them, sadly there are a few issues, other than certificate management - safari doesn't handle them well at all in my experience for example

How would you distinguish his/her IP from the list?

Country/time/user agent pair won't leave too much ambiguity. I'm talking about persons I know where they live.

Reply on news.ycombinator.com