Re:Apache Guacamole
by cm2187 on Saturday December 04, 2021 @07:23PM
(#29445612)
You might also consider an IP whitelist. The firewall is still probably the best place to stop any unwanted connection attempt. Also gives you good protection against zero days. Have a central location for what IPs are allowed to connect (like aws s3) and the server downloading it every 5min, and applying it to the firewall if it changed.
[ Parent
| on HN ]
Re:Apache Guacamole
by buybackoff on Sunday December 05, 2021 @05:10AM
(#29448124)
In most cases I use it via my smartphone with dynamic IPv6. A whitelist fir a train trip is impossible.
But don't you keep the same IP as you roam by train? All you need is a way to whitelist your new IP easily (I created a website that has just a button for that), and wait less than 5 minutes that the server picks up the new list.
Re:Apache Guacamole
by buybackoff on Sunday December 05, 2021 @05:28AM
(#29448205)
I've just checked before replying above, IP changes on every reconnect while being in the same room. It would be really bad usability with a whitelist. In my setup only 2FA cannot be saved in a browser, and login session is valid for a long time, so I do not have to re-login on every reconnect.