Groups | Blog | Home
all groups > dotnet security > july 2005 >

dotnet security : Web Service


Dominick Baier [DevelopMentor]
7/5/2005 2:25:31 PM
Hello Chris,

generally you can restrict pages/sites to be called only from specific IP
addresses. Go to IIS Manager, page, properties, directory security, IP Restrictions.

Keep in Mind - IP addresses can be spoofed and this is no bullet proof mechanism.
But surely a start.

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

[quoted text, click to view]


Yunus Emre ALPÖZEN [MCSD.NET]
7/5/2005 11:32:21 PM
what happens when u would like to add a new asp.net server???
U can ;
1. use client certificates which is my advice..
2. Set authentacation to windows use IIS to configure users which u want to
access. In this case, u should allow only remote machine's IIS user
account...
3. You can host your web services on a different port (like 22849) and then
allow accesses to this port from a specific IP. this is what u say..

--
HTH

Thanks,
Yunus Emre ALPÖZEN
BSc, MCSD.NET

[quoted text, click to view]

Chris Kennedy
7/6/2005 12:00:00 AM
Is there an easy way to restrict a web service so it can only called from
asp.net pages on another machine on the network? Ideally I'd like to base it
on IP address.

AddThis Social Bookmark Button