We heavily use Amazon EC2 instances for our infrastructure but one of the big drawbacks is that the IP addresses of the servers can change if a server is rebooted.
One of the developers is proposing that instead of using specific IP addresses, we use a subnet mask of 10.0.0.0/8 which would, essentially, allow any EC2 instance to try to authenticate against Crowd.
I realise that there is an extra layer of security here, i.e. application name and password, but presumably the IP address restriction was put into Crowd for a reason so I'm trying to understand what potential downsides there are to widen the subnet allowed.
The flipside would be that, in theory, I can use Amazon security groups to restrict the traffic reaching the Crowd server, the benefit being that security groups don't specify the actual IP addresses, just the virtual servers in the group so Amazon take care of the rules implicitly. The downside to this approach, though, is that the REST API uses the same port as normal human interaction with Crowd.
Is there any way to move the REST API onto a separate port so that I could lock that down at the network level?
Any other suggestions or comments on keeping this server secure whilst trying to meet the challenges of shifting IP addresses?
That's correct, the Remote Addresses tab within the Application settings in Crowd is used to basically enhance security.
Regarding REST API port, it's not possible to set a different port, but as you can see in this documentation, you can use host names (e.g.
myhost.com), instead of range of IPs to restrict access to your Crowd instance.
I hope it helps.
Hello Insight users, As part of our (Mindville's) acquisition by Atlassian, our training team is looking to build some new Insight training materials. It would really helpful if you can ...
Connect with like-minded Atlassian users at free events near you!Find an event
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no Community Events near you at the moment.Host an event