We want to control certain user pc that can access our website, is there anyway to do it? We are using vb.net and mysql for the website. Thank you.
Printable View
We want to control certain user pc that can access our website, is there anyway to do it? We are using vb.net and mysql for the website. Thank you.
When you say control...
Do you mean ???
#1 : Prevent the PC/User access to the website.
OR
#2 : Gain access to the PC and copy stuff to/from it.
We mean the first one
#1 : Prevent the PC/User access to the website.
Thanks
Okay I've got some code that works in ASP.NET (Vb code) that will identify the IP of the PC that is accessing the site.. You can then record and compare this IP to a blocked list and then decide what to reply to the user...
Unfortunately this code is on my Home PC and i'm at work... So i will post it a little later...
You could use the HTML META tag to achieve this. You just need to set the refresh value. Based on your code, the appropriate page can then be shown.
Hello HanneSThEGreaT,
I dont understand what you said, can you please explain in more detail?
How is it going to help me?
sorry it took so long... Been so busy and completely buggered when i get home, I clean forgot..
This code will return the IP of the PC connecting to the site...Code:'get last IP
LastIp = Request.ServerVariables("HTTP_X_FORWARDED_FOR")
If Not LastIp Is Nothing Then
FIps = Split(LastIp, ",", -1, CompareMethod.Text)
LastIp = FIps(FIps.Length - 1)
Else
LastIp = Request.ServerVariables("REMOTE_ADDR")
End If
There after you can use
Hope this helps you..Code:BIPs = GetBadIP() ' Return list of blocked IP's from the Database
For Each ThisBot In BIPs
If LastIp.ToUpper.Contains(ThisBot.IP.ToUpper) Then
Response.StatusCode = 410
Response.StatusDescription = "410 Gone"
Response.Status = "410 Gone"
Response.Write("Your IP has been reported as a source of malicious activity and all access has been revoked")
Response.Write(" If you think you are seeing this page in error. Please contact the webmaster")
Response.Write(" on {webmaster@domain} and quote '" & ThisBot.Name & "'.")
Response.Write(" ")
Response.End()
Exit Sub ' Stop processing this page..
End If
Next
Hello GremlinSA,
Thank you for your reply, but I not really understand.
What is Request.ServerVariables("HTTP_X_FORWARDED_FOR") and Request.ServerVariables("REMOTE_ADDR")?
Can you please explain more on it?
Every request for a webpage has a list of 'Server Variables' that is passed with the Page name request.. (Basic HTML Stuff)
REMOTE_ADDR will contain the IP of the Remote system requesting the page, and in the case of a Proxy Server we use
HTTP_X_FORWARDED_FOR which will contain the originating IP address, and if the request was Via multiple Proxy's we take the last IP in there...
see this wiki for more
I'm just curious to know that why not to restrict the user through username/password?
With reference to IP based restriction, what about if the same user come from some other IP? like by using any open proxy that gives anonymity to the actual user?
Only works if you have a site where you hand out logins..Quote:
Originally Posted by Ejaz
Else user can also just reregister with a different username.. With access to Gmail and Yahoomail, one can register 100's of accounts..
Hello GremlinSA,
I have some friend suggest to me to use RSA encryption function to do authentication. Each key(Public & Private key) will store in different side. Server will hold public key & client side will hold private key.
Will this method workable for my situation?
Unless the requirements specifically states to go with IP based security mechanism, I don't think that this is any form of security at all, due to following reasonsQuote:
Originally Posted by GremlinSA
- IP cannot be classified as user credential.
- IP is not a persistent identification mechanism. For example, that IP that is assigned to me (by my internet service provider), was in use by someone else before it was assigned to me and I don't know who'll have it when I'll disconnect.
- With reference to above point, if someone else is assigned the IP that I'm using right now (after I disconnect), then that someone will also not be able to access the site.
- Even if IP based user detection mechanism is implemented (which will certainly use some database at the back with the list of banned IP), then how will this database be filled with banned IP at the first place? Which means that someone has to wait for the particular user to come and banned him, which already push this mechanism at back foot.
- If you ban a series of IP (i.e. for a particular user group from some specific region), then all the people from the particular region will go down.
- All I need to change my IP is re-connect my connection, which is just a matter of simple 2 clicks. Unless I'm using some application with state oriented connections, I don't have any problem doing that.
Now the standard username/password mechanism doesn't provide you 100% fool proof security system either, as you mentioned (which is pretty common) that a user can sign up multiple accounts, however
- This approach push the user to go beyond simple 2 clicks, which means
- The user has to create another email id.
- The user has to sign up another account with you
This way, the particular user has to do some efforts to hook up with the particular site.- You are still in better position that its up to you that whether you want to allow the user or not(at the first place, i.e. at sign up)
- You'll not face user collision issue (i.e. two users sharing the same IP at different time)
- You can ask the user to accept some AUP, which gives you legal coverage.
- In order to create thousands of different user accounts with *you*, the user has to equally misuse GMail/Yahoo as well. The particular user is not only fiddling with you, but with other parties too. Therefore, its not only *your* AUP that he is violating, he has to do more then that.
- Not all users want to spam your system. For serious users, its very important that their identities remain valid. Such as, I don't want my particular user id at CG gets banned here or I have to change my e-mail just for CG, as I've been using the same ID for more then 10 years and everyone else users the same ID to reach me, it would be really hard if I've to change it.
This is more or less exactly what we do here as well. Any user violates AUP, is banned (i.e. his user account), not his IP. Additionally, if a stronger security level is required, then I would suggest to use something like digital certificates.
Security comes at cost. The question is what level of security is good enough for you. The more sophisticated mechanisms you'll include, the higher will be the cost (up front and on going basis), so you have to measure the cost/benefit ratio for yourself.Quote:
Originally Posted by xpossupport
Are You Sure?? check this thread..Quote:
Originally Posted by Ejaz
If there is excessive Spam, Etc coming from a Specific IP, CG admin do block the IP..
Also on my Forum site i use several methods to block out Spammers and Bandwidth wasters..
But I always do some homework on the IP's before i block them .. Like this one IP i eventually blocked that had a different UserAgent with every visit (even within the same tracking cookie).. Then I also block according to UserAgents ...
Once Your Running and Monitoring your Own WebSite/ WebServer, You'd be surprised by the Amount of Crap out there that tries to Hack, Copy or Crash a website...
And with Public Access Sites (Like CG) you can't simply rely on user access blocking, because they still have 100% access to the site(maybe with out been able to post/ comment), and this still allows people to be malicious on the site.. SQL injection attacks don't require the user to be registered, just that the site accepts his requests..
These are all reactive counter measures. Someone has to do something against some rules, so that particular person can be analysed for the respective procedure (i.e. being IP banned).Quote:
Originally Posted by GremlinSA
If one has to deal with DoS/DDoS or any other form of attacks, its one thing but here (if I'm not mistaken) the issue is to provide access of a web site to only valid users.
Perhaps the OP can clarify that what exactly he/she wants?
Hello Ejaz,
I would like to know what is digital certificates ? How did it work ? How do I implement in asp.net ?
Before everything else, Please explain what exactly is your scenario? There might be simpler ways to achieve what you want, but until anyone else knows about the details, they cannot give you the best possible solution.Quote:
Originally Posted by xpossupport
Hello Ejaz,
My scenario:
User can only access to my website through certain pc only. User cannot access from other pc.
Thank you.
If this is *all* what you need, then you don't need anything fancy at all. You can simplyQuote:
Originally Posted by xpossupport
- Deploy your website at your LAN (which isn't hard, you must be doing that already in development)
- Make sure that the particular machine cannot be accessed from internet (i.e. no public IP)
- The one *particular* user or the PC that you want to have the access to the website can be provided the access via VPN (your network guys should do it easily).
Hello Ejaz,
If we want control user on internet, not LAN. Is it possible?
Thank you
Google for "VPN" or "Virtual Private Network". See how it works and how can it fit in your situation.Quote:
Originally Posted by xpossupport