2

I have an ASP.NET site hosted on GoDaddy Plesk. I'm restricting site access using a whitelist of IP addresses to prevent web crawlers from seeing it, but the clients who need to see the site have residential internet service with a non-static IP address. Is there a way to give them access without removing the whitelist altogether? They can always purchase static IP from the ISP, but for $15/month, I'd like to see if there's a viable, free/cheaper option.

2

Most broadband providers provide dynamic IP addresses so whitelisting is not realistic and one of the reasons why generally people don't use it. You will not be able to blacklist and whitelist in this manner but you can whitelist an IP range since most internet providers will allocate C class IP addresses to the area where the user is accessing the service from.

To understand C class IP addresses here is a quick rundown:

24.115.1.19 = A.B.C.D, so if the the user has an IP address of 24.115.1.19 the C class would be 1, so you could allow just 24.115.1.* which means 24.115.1.1 to 24.115.1.254. But some ISPS run with many C class IP addresses in some areas, especially if they are DENSE populated ones, so you need to monitor it and keep adding them as they appear, eventually you will catch them all, until the ISP adds more to that area.

But there's no need to restrict by IP address

Plesk is not the weakest link, most hackers won't even attempt it if the Plesk is updated regularly and becomes near impossible to hack without a 0-day hack which most often that would be sold to intelligence services anyhow! (cough tinfoil hat).

If you want to lock down your Plesk, do yourself and your users a favor by enforcing Plesk users to use two-way authentication, Plesk has several plugins that allow this, i.e Plesk, Google two-way authentication.

  • Thanks for your thorough answer. However, since my site is hosted on a shared server through GoDaddy, I can only choose from a small list of applications to install, and Google Authenticator is not on the list. Is it possible to use built-in Windows authentication on the site without a whitelist? That way at least it's still locked down. Any way I can accomplish this without having to manually code authentication into my site, I'm willing to try. I'm hoping to avoid whitelisting large IP address blocks, as web crawlers and other users could still potentially get through. – Jacob Stamm Jun 28 '17 at 17:59
  • Active Directory and LDAP authentication is not a feature of Plesk and can only be extended through the use of Plugins. If you are concerned about security then really you shouldn't be using an 'open' shared hosting environment. If you want security and the flexibility in controlling the login process outside of what Plesk provides out of the box then the platform you should be using is a Virtual Machine or Dedicated server. Microsoft Azure provides a pay monthly Plesk Onyx license on Windows or Linux. – Simon Hayter Jun 29 '17 at 15:36
  • I'm not concerned with security so much as I am with privacy, making sure ugly in-progress stuff isn't seen by web crawlers and unsuspecting Googlers. As far as I know, shared hosting on GoDaddy is secure enough for my purposes. All I really need to know is if GoDaddy offers Windows user accounts on shared servers. In theory, they could create a user account with only permissions for my site directories, no RDP, etc., and that would do the trick. I suppose I'll go see if they offer that. – Jacob Stamm Jun 29 '17 at 18:11
  • 1
    GoDaddy will just tell you to get a VM. Shared hosting environments are locked down to the very basics to ensure compatibility, little maintenance, reliability, and security. Furthermore, in terms of privacy, shared hosting is absolutely awful because your data is openly stored on the server which can be accessed by anyone at GoDaddy and Hackers which can come onto the system through someone else's site. Also, from time to time and it is rare but does happen that sites can sometimes index on someone else's domain. If you want privacy, VM, if you want security VM if you want more control VM. – Simon Hayter Jun 30 '17 at 1:56
  • 1
    You can get a VM roughly for the same cost of your GoDaddy anyway. Azure has an image with Windows and Plesk that can be fired up within a couple of mins and your away. Also, you can signup as a developer and your get £20 a month credit for one year which will cover most of the costs. Anyhow, up to you but shared hosting is limited for many reasons, mostly price. – Simon Hayter Jun 30 '17 at 1:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.