Accessed based off of IP...

[StinkFinger]

All,
There are certain scripts that I have that only I want to run, both from
home and sometimes work. If I add something like this (below) to the
scripts, will this keep out unauthorized use (if the scripts are found
somehow), or can the REMOTE_ADDR be easily spoofed ?

Should I be checking HTTP_CLIENT_IP and HTTP_X_FORWARDE D_FOR also ?

$ip = $_SERVER["REMOTE_ADD R"];
if (($ip == "x.x.x.x") or ($ip == "y.y.y.y"))
{
//secret stuff
}
else
{
echo "<META HTTP-EQUIV=\"refresh \" content=\"0; url=/index.php\">";
die();
}

or something like this:

function getipaddress()
{
$ip;
if (getenv("HTTP_C LIENT_IP")) $ip = getenv("HTTP_CL IENT_IP");
else if (getenv("HTTP_X _FORWARDED_FOR" )) $ip =
getenv("HTTP_X_ FORWARDED_FOR") ;
else if (getenv("REMOTE _ADDR")) $ip = getenv("REMOTE_ ADDR");
else $ip = "UNKNOWN";
return $ip;
}

$ip = getipaddress();
if(($ip == "x.x.x.x") or ($ip == "y.y.y.y"))
{
//secret stuff
} else {
echo "<META HTTP-EQUIV=\"refresh \" content=\"0; url=/index.php\">";
die();
}

Thanks.

[Chung Leong]

Re: Accessed based off of IP...

"StinkFinge r" <stinky@pinky.c om> wrote in message
news:1084f1bc39 v5581@corp.supe rnews.com...[color=blue]
> All,
> There are certain scripts that I have that only I want to run, both from
> home and sometimes work. If I add something like this (below) to the
> scripts, will this keep out unauthorized use (if the scripts are found
> somehow), or can the REMOTE_ADDR be easily spoofed ?[/color]

You can send TCP/IP packets with fake return addresses fairly easily. But to
take advantage of it in an attack against a web server is hard, I believe,
as the HTTP response would get routed to the real address.

[Dan Tripp]

Re: Accessed based off of IP...

Chung Leong wrote:[color=blue]
> "StinkFinge r" <stinky@pinky.c om> wrote in message
> news:1084f1bc39 v5581@corp.supe rnews.com...
>[color=green]
>>All,
>>There are certain scripts that I have that only I want to run, both from
>>home and sometimes work. If I add something like this (below) to the
>>scripts, will this keep out unauthorized use (if the scripts are found
>>somehow), or can the REMOTE_ADDR be easily spoofed ?[/color]
>
>
> You can send TCP/IP packets with fake return addresses fairly easily. But to
> take advantage of it in an attack against a web server is hard, I believe,
> as the HTTP response would get routed to the real address.
>
>[/color]

Just kinda thinking out loud... by why not limit access to the directory
your scripts are in with .htaccess or IIS's authentication? That'd
probably be a bit more secure than relying upon the REMOTE_ADDR.

Regards,

- Dan

http://blog.dantripp.com

[Chris Hope]

Re: Accessed based off of IP...

Dan Tripp wrote:
[color=blue][color=green][color=darkred]
>>>There are certain scripts that I have that only I want to run, both from
>>>home and sometimes work. If I add something like this (below) to the
>>>scripts, will this keep out unauthorized use (if the scripts are found
>>>somehow), or can the REMOTE_ADDR be easily spoofed ?[/color]
>>
>>
>> You can send TCP/IP packets with fake return addresses fairly easily. But
>> to take advantage of it in an attack against a web server is hard, I
>> believe, as the HTTP response would get routed to the real address.
>>[/color]
>
> Just kinda thinking out loud... by why not limit access to the directory
> your scripts are in with .htaccess or IIS's authentication? That'd
> probably be a bit more secure than relying upon the REMOTE_ADDR.[/color]

Not an answer to your solution, but a suggestion that instead of writing out
a meta tag refresh you might want to do this instead:

header("Locatio n: /index.php");
exit;

Chris

--
Chris Hope
The Electric Toolbox Ltd

http://www.electrictoolbox.com/