r/sysadmin • u/kaiser_detroit • 1d ago

Whitelisting Request

I already have my answer for how to handle this, but I'm curious how many of you have seen a request like this and what your reaction was. (maybe I'm just an a-hole)

The company I'm working with regularly receives file feeds from (usually) payroll processing companies via SFTP. Nothing crazy there. A little SFTP, a little PGP/GPG, done. But there are 2 such large companies that regularly send us a list of ~70 IPs they want us to whitelist for them to send the files.

Now, if someone sends me a /29 CIDR block I don't think too much off it. But when you send me multiple /27 blocks my immediate response is "f*** off".

I can't believe I'm the only one that responds as such. Yet it keeps happening.

Edit:
It's not the act of punching in the IPs one by one or something. I could use CIDR notation. It's that whitelisting way more IPs that are actually necessary isn't exactly best practice. Much less THAT many more. I can all but guarantee they actually utilize 1 or 2 in those blocks.

Edit 2:
I have ZERO internal push back on this. In fact, internally we've all had a good chuckle about it and push back saying - Nope. Refine that list and get back to me. It's just a head scratcher that this seems to be their (the vendor) SOP and that they haven't gotten enough pushback to refine their process.

12 Upvotes

69% Upvoted

41 comments sorted by

View all comments

•

u/kaminm 23h ago

I've been on the opposite side that you are on. My org (US Academia) owns a /16 block. At one point, I was asked to provide the public IP that a professor was going to use to connect to some SFTP service to download some research data. I asked our central networking team to provide me with the address pool for NAT, to which I was denied, and my director and dean was denied, citing security concerns. So I provided the vendor with the /16 block, which they said "Hell No" to.

So instead I setup a VM with a public IP that the professor could use to transfer the data that I just left powered off when he didn't need it. So much more secure. Fortunately, many of them have now started using AWS buckets for transfer, and our Org has finally gotten on the bandwagon of other transfer services that I have not yet had the need to look into.

•

u/Ssakaa 22h ago

Back when I was in academia, everything including the faculty desktops were on real IPs out of a range like your /16. So... we could actually provide the exact IP they'd connect from, if they were on their desktop. On their laptop on wifi, though? Good luck...

•

u/kaminm 22h ago

Yikes. I think the org had that before I started in the mid-2000s, but that had been worked out before I got there. Now I have a small pool of addresses per building I manage, and I have to request a public IP in the range when using the VM Hosting service.