You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@guacamole.apache.org by Steven Galante <st...@stonybrook.edu> on 2018/04/09 15:15:39 UTC
Select User Connection Restricted by Source IP
I understand this is counter intuitive to Guacamole's purpose. Though, I
have use case were we would like to be able to restrict select connections
for users by source IP. Has anyone come across this? and if so, how did you
come over it?
Thanks,
Steve
Re: Select User Connection Restricted by Source IP
Posted by Nick Couchman <vn...@apache.org>.
On Mon, Apr 9, 2018 at 12:13 PM, Tom Astle <to...@pcc.com> wrote:
> I'll add a "me too" for this. I'd also like to use the upcoming TOTP
> support with this so that if someone was coming from a certain subnet, say
> an RFC1918 private, they would not have to use the 2fa. Presently, we are
> looking at using Duo for this, which is really expensive in scale.
>
>
I would think this would be possible, as well, but may require a little
more work than just filtering out connections. This might actually require
customizing the TOTP module to allow you to configure scenarios where you
require 2FA or bypass it, but, again, should be very doable.
-Nick
Re: Select User Connection Restricted by Source IP
Posted by Tom Astle <to...@pcc.com>.
I'll add a "me too" for this. I'd also like to use the upcoming TOTP support with this so that if someone was coming from a certain subnet, say an RFC1918 private, they would not have to use the 2fa. Presently, we are looking at using Duo for this, which is really expensive in scale.
----- On Apr 9, 2018, at 11:15 AM, Steven Galante <st...@stonybrook.edu> wrote:
> I understand this is counter intuitive to Guacamole's purpose. Though, I have
> use case were we would like to be able to restrict select connections for users
> by source IP. Has anyone come across this? and if so, how did you come over it?
> Thanks,
> Steve
Re: Select User Connection Restricted by Source IP
Posted by Nick Couchman <vn...@apache.org>.
>
>
> > Off the top of my head:
> >
> > * You step away from the computer and need to check something via your
> > phone.
> >
> > * You lock your screen at work without logging out from guac, head home,
> > and need to log in again.
> >
> > * You are using an anonymizing service which changes IP occasionally.
> >
> > - Mike
> Sure, all of the three cases are valid, but regardless of their
> justifiability they are perfect case for attacker to mask his activity.
>
This could be said of many different pieces of functionality, at many
different levels across many different technologies. The perfectly secure
computer is locked in a safe and completely powered off, but it isn't very
useful. The perfectly usable computer is accessible to everyone with no
restrictions, but lacks any notion of security. The rest of the spectrum
is a trade between security and functionality. Perhaps in your use-case or
environment restricting users to a single IP is a requirement or something
that you strongly desire. That's great, you're welcome to implement it
that way. For most of the rest of us, our ability to use the software from
multiple IP addresses concurrently is an acceptable risk with beneficial
functionality, and there are other risks that merit more time and attention
- like multi-factor authentication.
> Whether to enable them or not is a matter of choice and a matter of
> required
> defense grade.
>
>
I agree, and if you'd like to implement a modification or an extension that
restricts users to only log in from a single IP at a time, you are welcome
to - the software is open source, and can fork/modify/contribute to it.
It's how I got started contributing to the project :-). However, you
should understand that, because many other people don't consider this a
requirement it is unlikely that 1) it will be adopted as a default behavior
of the software, or 2) that other developers will spend time implementing
such a feature in the near-term.
-Nick
Re: Select User Connection Restricted by Source IP
Posted by Suncatcher16 <su...@outlook.com>.
Mike Jumper wrote
> On Sun, May 13, 2018, 04:49 Suncatcher16 <
> suncatcher16@
> > wrote:
>
>> Just a matter of taste. Both use-cases require extensions anyway. LAN/WAN
>> differentiation seems more important for me.
>>
>> BTW, how can single user connect from different IPs simultaneously? It's
>> a
>> great breach for attacker, which could mask malicious activity. I cannot
>> imagine such use-case where that might be needed. Do you?
>>
> Off the top of my head:
>
> * You step away from the computer and need to check something via your
> phone.
>
> * You lock your screen at work without logging out from guac, head home,
> and need to log in again.
>
> * You are using an anonymizing service which changes IP occasionally.
>
> - Mike
Sure, all of the three cases are valid, but regardless of their
justifiability they are perfect case for attacker to mask his activity.
Whether to enable them or not is a matter of choice and a matter of required
defense grade.
--
Sent from: http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/
Re: Select User Connection Restricted by Source IP
Posted by Mike Jumper <mi...@guac-dev.org>.
On Sun, May 13, 2018, 04:49 Suncatcher16 <su...@outlook.com> wrote:
> Just a matter of taste. Both use-cases require extensions anyway. LAN/WAN
> differentiation seems more important for me.
>
> BTW, how can single user connect from different IPs simultaneously? It's a
> great breach for attacker, which could mask malicious activity. I cannot
> imagine such use-case where that might be needed. Do you?
>
Off the top of my head:
* You step away from the computer and need to check something via your
phone.
* You lock your screen at work without logging out from guac, head home,
and need to log in again.
* You are using an anonymizing service which changes IP occasionally.
etc.
Different IPs means that you provided your user to smb else who connects
> from different location, this is what users were created for, imho.
>
Nope. It might mean that, but this isn't guaranteed (see above).
Regardless, the fact that a user may choose to share their password isn't a
potential breach in the system; it's a poor choice on the user's part.
If you wish to make doubly sure that a user is who they claim to be, that's
exactly the use case behind 2FA.
- Mike
Re: Select User Connection Restricted by Source IP
Posted by Suncatcher16 <su...@outlook.com>.
Just a matter of taste. Both use-cases require extensions anyway. LAN/WAN
differentiation seems more important for me.
BTW, how can single user connect from different IPs simultaneously? It's a
great breach for attacker, which could mask malicious activity. I cannot
imagine such use-case where that might be needed. Do you?
Different IPs means that you provided your user to smb else who connects
from different location, this is what users were created for, imho.
One man = one user! This is a rule of thumb
<https://www.compulite.ca/generic-user-accounts/> of cyber security.
--
Sent from: http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/
Re: Select User Connection Restricted by Source IP
Posted by Nick Couchman <vn...@apache.org>.
On Sun, May 13, 2018 at 7:08 AM, Suncatcher16 <su...@outlook.com>
wrote:
> vnick wrote
> > On Mon, Apr 9, 2018 at 11:15 AM, Steven Galante <
>
> > steven.galante@
>
> >> wrote:
> > I don't think it has been implemented by anyone, yet, but should be very
> > doable - it will require writing a custom Authentication Extension
> > -Nick
>
> Exactly. One need to write an extension. The question for already asked by
> me a year ago.
>
I actually think the two requests are very slightly different. Yours was
asking about restricting access to Guacamole, in general, and filtering at
a user level. Steven is asking about doing it at a connection level. Very
similar concepts, to be sure, but slightly different. I think both are
possible through the use of an extension - just needs to be written.
-Nick
Re: Select User Connection Restricted by Source IP
Posted by Suncatcher16 <su...@outlook.com>.
vnick wrote
> On Mon, Apr 9, 2018 at 11:15 AM, Steven Galante <
> steven.galante@
>> wrote:
> I don't think it has been implemented by anyone, yet, but should be very
> doable - it will require writing a custom Authentication Extension
> -Nick
Exactly. One need to write an extension. The question for already asked by
me a year ago.
http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/Restrict-user-by-IP-td1175.html
<http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/Restrict-user-by-IP-td1175.html>
--
Sent from: http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/
Re: Select User Connection Restricted by Source IP
Posted by Nick Couchman <vn...@apache.org>.
On Mon, Apr 9, 2018 at 11:15 AM, Steven Galante <
steven.galante@stonybrook.edu> wrote:
> I understand this is counter intuitive to Guacamole's purpose. Though, I
> have use case were we would like to be able to restrict select connections
> for users by source IP. Has anyone come across this? and if so, how did you
> come over it?
>
>
I wouldn't even say this is counter-intuitive to Guacamole's purpose. It
may not be the mainstream of what everyone wants, but it sounds perfectly
reasonable to me.
I don't think it has been implemented by anyone, yet, but should be very
doable - it will require writing a custom Authentication Extension for
Guacamole that looks at the source IP and determines what connections would
be available to someone coming from that IP. With the recent additions of
"decoration" to the modules, I would think this would be very doable.
-Nick