Maxoq
Well-known member
- Joined
- Feb 25, 2015
- Messages
- 544
- Points
- 28
Every panel and internal API I run ends up behind an IP allow-list eventually, and twice now I have locked myself out of one. Both times for the same reason: the list was filled in by typing an address into a form, and the address I typed was the one I believed I was coming from rather than the one the server actually saw.
What fixed it was refusing to take the address as input at all. The endpoint that turns the lock on reads REMOTE_ADDR from that same request and stores that. Whatever address got the request through is the address that gets allowed, so it cannot be wrong by construction. Behind a proxy or a tunnel you have to be careful which header you trust, but the principle survives.
Second thing, and it has saved me more often than the first: a way back in that does not go through the allow-list. Where the setting lives in MySQL that is one DELETE over SSH. Where it lives in a config file it is a comment above the line saying what to remove. Written down somewhere other than that machine, because the moment you need it is the moment you cannot log in.
Residential IPs rotating is the usual trigger. Mine changed after a router reboot and I did not find out until the next deploy failed.
For those running allow-lists on client servers, do you pin them to a static IP or a VPN endpoint, or just accept re-adding the address every few months?
What fixed it was refusing to take the address as input at all. The endpoint that turns the lock on reads REMOTE_ADDR from that same request and stores that. Whatever address got the request through is the address that gets allowed, so it cannot be wrong by construction. Behind a proxy or a tunnel you have to be careful which header you trust, but the principle survives.
Second thing, and it has saved me more often than the first: a way back in that does not go through the allow-list. Where the setting lives in MySQL that is one DELETE over SSH. Where it lives in a config file it is a comment above the line saying what to remove. Written down somewhere other than that machine, because the moment you need it is the moment you cannot log in.
Residential IPs rotating is the usual trigger. Mine changed after a router reboot and I did not find out until the next deploy failed.
For those running allow-lists on client servers, do you pin them to a static IP or a VPN endpoint, or just accept re-adding the address every few months?
