Crowd REST API security

We heavily use Amazon EC2 instances for our infrastructure but one of the big drawbacks is that the IP addresses of the servers can change if a server is rebooted.

One of the developers is proposing that instead of using specific IP addresses, we use a subnet mask of 10.0.0.0/8 which would, essentially, allow any EC2 instance to try to authenticate against Crowd.

I realise that there is an extra layer of security here, i.e. application name and password, but presumably the IP address restriction was put into Crowd for a reason so I'm trying to understand what potential downsides there are to widen the subnet allowed.

The flipside would be that, in theory, I can use Amazon security groups to restrict the traffic reaching the Crowd server, the benefit being that security groups don't specify the actual IP addresses, just the virtual servers in the group so Amazon take care of the rules implicitly. The downside to this approach, though, is that the REST API uses the same port as normal human interaction with Crowd.

Is there any way to move the REST API onto a separate port so that I could lock that down at the network level?

Any other suggestions or comments on keeping this server secure whilst trying to meet the challenges of shifting IP addresses?

Thanks.

1 answer

1 accepted

This widget could not be displayed.

Hi Philip,

That's correct, the Remote Addresses tab within the Application settings in Crowd is used to basically enhance security.

Regarding REST API port, it's not possible to set a different port, but as you can see in this documentation, you can use host names (e.g. myhost.com), instead of range of IPs to restrict access to your Crowd instance.

I hope it helps.

Cheers

Thanks for the clarification.

Suggest an answer

Log in or Sign up to answer
Community showcase
Published Feb 27, 2018 in Crowd

The Crowd team is looking for feedback on Server & Data Center customers' identity strategies!

Do you own more than one Server or Data Center product? Do you have challenges provisioning users across your Atlassian products? Are you spending a lot of time integrating each Atlassian product wit...

1,458 views 6 14
Read article

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you