We heavily use Amazon EC2 instances for our infrastructure but one of the big drawbacks is that the IP addresses of the servers can change if a server is rebooted.
One of the developers is proposing that instead of using specific IP addresses, we use a subnet mask of 10.0.0.0/8 which would, essentially, allow any EC2 instance to try to authenticate against Crowd.
I realise that there is an extra layer of security here, i.e. application name and password, but presumably the IP address restriction was put into Crowd for a reason so I'm trying to understand what potential downsides there are to widen the subnet allowed.
The flipside would be that, in theory, I can use Amazon security groups to restrict the traffic reaching the Crowd server, the benefit being that security groups don't specify the actual IP addresses, just the virtual servers in the group so Amazon take care of the rules implicitly. The downside to this approach, though, is that the REST API uses the same port as normal human interaction with Crowd.
Is there any way to move the REST API onto a separate port so that I could lock that down at the network level?
Any other suggestions or comments on keeping this server secure whilst trying to meet the challenges of shifting IP addresses?
That's correct, the Remote Addresses tab within the Application settings in Crowd is used to basically enhance security.
Regarding REST API port, it's not possible to set a different port, but as you can see in this documentation, you can use host names (e.g.
myhost.com), instead of range of IPs to restrict access to your Crowd instance.
I hope it helps.
This community is celebrating its one-year anniversary and Atlassian co-founder Mike Cannon-Brookes has all the feels.Read more
Do you own more than one Server or Data Center product? Do you have challenges provisioning users across your Atlassian products? Are you spending a lot of time integrating each Atlassian product wit...
Connect with like-minded Atlassian users at free events near you!Find a group
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no AUG chapters near you at the moment.Start an AUG
You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs