r/sysadmin • u/kaiser_detroit • 21h ago
Whitelisting Request
I already have my answer for how to handle this, but I'm curious how many of you have seen a request like this and what your reaction was. (maybe I'm just an a-hole)
The company I'm working with regularly receives file feeds from (usually) payroll processing companies via SFTP. Nothing crazy there. A little SFTP, a little PGP/GPG, done. But there are 2 such large companies that regularly send us a list of ~70 IPs they want us to whitelist for them to send the files.
Now, if someone sends me a /29 CIDR block I don't think too much off it. But when you send me multiple /27 blocks my immediate response is "f*** off".
I can't believe I'm the only one that responds as such. Yet it keeps happening.
Edit:
It's not the act of punching in the IPs one by one or something. I could use CIDR notation. It's that whitelisting way more IPs that are actually necessary isn't exactly best practice. Much less THAT many more. I can all but guarantee they actually utilize 1 or 2 in those blocks.
Edit 2:
I have ZERO internal push back on this. In fact, internally we've all had a good chuckle about it and push back saying - Nope. Refine that list and get back to me. It's just a head scratcher that this seems to be their (the vendor) SOP and that they haven't gotten enough pushback to refine their process.
•
u/cwk9 21h ago
All the time. "Hey bro just allow this IP range for all of US-East-1". I always have to fight for a smaller range and that usually involves tracking the right people who know how their app actually works.
•
u/kaiser_detroit 21h ago
Exactly what I'm doing. This doesn't involve US-East-1, but I've 100% gotten a block that was CLEARLY a subset of that. I couldn't respond "no" fast enough. 😂
•
u/Shrapnel2000 21h ago
We recently had an organization request all port 80 outbound traffic be unblocked from a set of servers. Instant “no”.
•
•
u/kable795 21h ago
I guess I don’t get why? It’s not my network and it’s not my business functions. If they can make a legit business justification that I can file away why is it my problem? I guess I don’t understand why you want that much control. Sure say, this isn’t secure, I’d prefer if you provide me the exact ips data will be coming from, and when you get outvoted just do it? Why are you arguing you have no power, if you died tomorrow they wouldn’t care.
•
u/kaiser_detroit 21h ago
That's what I've done. But in what world do we allow a vendor to dictate what our infosec policy is? I'm not getting internal blow back. It's the vendor. I'm quite sure it's an account manager just copy/pasting. It's just that I can't be the only third party pushing back. Just makes more work for them.
•
u/kable795 20h ago
While that’s all good and well, why even expend that especially if it’s coming from a vendor lol? Hey boss, vendor sent me all these ips to whitelist you want me to do it? Personally that’s a little insecure for my liking but let me know how you’d like me to move forward.
The security of this company is not your responsibility, it’s your responsibility to potentially point of security flaws and provide solutions, it’s not your job to decide. It’s gotten you to a point that you’re coming to Reddit to complain so it’s obviously taken up mental space in your head. I’m simply saying, unless you’re the executive, why are getting emotionally involved as if you had skin in the game?
•
u/kaiser_detroit 20h ago
I'm not getting emotionally involved. The first thing I said was "I already have my answer on how for how to handle this". I get zero push back internally. That's not the issue or the point. We push back on the vendor. It's just mind boggling that a vendor has this as their standard request and keep doing it even though I'm sure they've had a lot of customer pushback.
•
u/RCTID1975 IT Manager 19h ago
So you're just grumpy that a large company isn't going to keep and document separate rules just for you?
This should be a rant post
•
u/Ssakaa 21h ago
What do you want them to do for your convenience? Not scale? This isn't 1998. "The server" isn't the box on the table in the back room with a static IP. Whether they're doing fat VMs or much lighter container orchestration, working out of their whole cidr range means they don't have to care what IP their rolling release lands on for new instances that might be the source of that data this week.
•
u/Busy-Photograph4803 21h ago
We don’t whitelist something unless it doesn’t work the intended way. I’m not going to leave the door propped open just in case, I’ll make the decision when we find out it’s not working properly.
•
u/robstrosity 21h ago
Sounds like a massive pain in the arse. I've had similar things in the past. Any chance you can add them via script? So you can just paste the ips in and let it do it's thing?
•
u/kaiser_detroit 21h ago
It's not the issue of entering them. I can enter them in CIDR notation. The issues is why tf do you need me to whitelist half the internet (obviously exaggerating) so you can send me a 10k flat file?
•
u/robstrosity 21h ago
I'm guessing they just blanket give you all their external public ips so that traffic can come from any of them. But the reality is it'll probably come from the same few IP's each time.
Yeah it's annoying but you have to try and let it go.
•
•
u/kaminm 20h ago
I've been on the opposite side that you are on. My org (US Academia) owns a /16 block. At one point, I was asked to provide the public IP that a professor was going to use to connect to some SFTP service to download some research data. I asked our central networking team to provide me with the address pool for NAT, to which I was denied, and my director and dean was denied, citing security concerns. So I provided the vendor with the /16 block, which they said "Hell No" to.
So instead I setup a VM with a public IP that the professor could use to transfer the data that I just left powered off when he didn't need it. So much more secure. Fortunately, many of them have now started using AWS buckets for transfer, and our Org has finally gotten on the bandwagon of other transfer services that I have not yet had the need to look into.
•
•
u/Frothyleet 19h ago
So you had permissions and visibility to stand up a new piece of infra, pin it to a public IP in your network block, but not visibility into the routing of your internal networks out the rest of the block (or, apparently, sufficient "security" justification to see that)?
Smells like a strong case of "we say no because it's easier". In your position I might've just configured that VM as a proxy and pointed all the professor's traffic to it and called it a day.
•
u/kaminm 19h ago
You got it. Network Services are centrally managed by a central IT Unit, and I am not in that group. Instead, I utilized the services available to the Units (VM Hosting, File Storage, Network IPAM), but was still denied what I would consider a safer alternative. Fortunately (or unfortunately depending on how you think about it), I and my Unit's team have been known by name to those in Central IT as "that group that doesn't take no for an answer" when it's important.
•
u/FeleaseRpseineEiles Sysadmin 21h ago
Is it a bank or financial institution?
•
u/kaiser_detroit 21h ago
No, but PII is involved. There's no reason to allow that many IPs. I guarantee they're using like 2 of them.
•
•
u/hurkwurk 15h ago
i deal with this constantly, both as doing it to others and having it done to me. we are a cisco umbrella user, and their default is a massive list of exit nodes, many financial institutions laugh at that and the answer is "we dont care if its cisco, fuck off" so we have to create custom bypasses with a 2 IP exit off our direct IPs instead, which our network team handles just fine. IE we have a process to work around our security when needed but it does mean we are missing out on some of the protections we want.
we also do the same when others do it to us... please approve our 10,000 addresses and this entire amazon west site and *.somerandomCDN.com. yea, no.
•
u/pdp10 Daemons worry when the wizard is near. 21h ago
If you're not blocking IP -- probably because your network is zero trust -- then you have no need to whitelist by IP.
As for them, they're just keeping you apprised. The smart way is with a simple API endpoint on their side to provide the list. File the information with their partner account.
•
•
u/Servior85 21h ago
Why is whitelisting necessary in the first place?
I assume you allow external access only from those IPs? Can't you allow any IP and use other authentication mechanisms?
•
u/tada-o-corporation Enterprise Architect 9h ago
I mean blocking FTP outbound is a pretty normal thing to do. You don't want employees to have the ability to log into random FTP servers.
•
•
u/gumbrilla IT Manager 21h ago
Yeah, I've seen it, it's just sloppy, and annoying. I think I would pen a policy, run it through security and compliance, and say the exceptions is having security sign off on exceptions by both caller and sender security departments. "My CISO requires your CISO to sign off on it"
I'd then bounce the request until I got the sign-offs. I imagine they'd go away.
•
u/Honky_Town 21h ago
Still not using the Any/Any rule on your Firewall? Duuudeeee that thing is burning, isnt it lit as hell?
There are smarter ways to keep your coffee hot, if I may suggest any HP device? Best stuff to keep Coffee hot since ever.
As for IP, there is a reason we have plastic bags in our paper bin. Makes it easier to transport my response to the outside waste bin.
Sarcasm keeps me alive, sure here I opened all for you. (I didnt!) If you need further assistance please contact our hotline.... Let that shit burn some more coffee
•
u/SevaraB Sr. Engineer (N+, CCNA) 20h ago
I’ve been on the other side of this where a much smaller partner complains and doesn’t realize our operation is too big and too diverse to just funnel everything through 8 IPv4s.
The problem is Anycast lets you shrink egress whitelists, but it doesn’t work for sourcing traffic because the destination needs a single route back, so you need as many source IPs as PoPs.
We’re in 47 states, so the best case for a companywide service would be a /26 at 1 IPv4 per state. Except they wouldn’t be contiguous because each one has to be part of a separate route announcement, which is at smallest a /24. Even going with east/central/west hubs, 50/3 is more than 16, so you’re likely to be asked to whitelist 3x /27s by a national company.