Hi,
Firstly: I appreciate this is going to be a very specific request and it might be too obscure to warrant the time investment, but if you don’t ask you never know.
I’d like to see a feature improvement for account authentication to enable specific accounts to only be allowed to sign in from specific IP addresses.
At present we can control access to the Web UI from Port 443, however this allows all accounts to sign in. I always recommend to customers to enable MFA to secure the accounts, so between MFA + restricted IP scope, there’s less risk of an attack. But the ‘service account’ used for VBR & VBfMA integration does not support MFA, undermining the security benefits that MFA brings. However as VBfMA can only integrate with a single VBR instance, I’d like to see the ability to lock these accounts down further via confirming the sign in request is coming from VBR’s IP address ONLY.
In summary, conditional access to the web UI using source IP as an evaluating factor in approving authentication.
Alternative ideas for securing further would be:
- Allowing this service account to sign in with certificate authentication
- Separating ports for VM integration from web UI.
This feature request is focused on security, if I need to enable port 443 on an Azure VM that gets compromised, it’s possible the attacker could then connect to the web UI and use a non-MFA’d account to sign in. Granted it’s not the easiest attack, but certainly possible.
-
- Veeam Software
- Posts: 219
- Liked: 111 times
- Joined: Jun 29, 2015 9:21 am
- Full Name: Michael Paul
- Contact:
Feature Request: Limit Allowed IP Address Sign-In for specific accounts
-------------
Michael Paul
Veeam Data Cloud: Microsoft 365 Solution Engineer
Michael Paul
Veeam Data Cloud: Microsoft 365 Solution Engineer
-
- Product Manager
- Posts: 5797
- Liked: 1215 times
- Joined: Jul 15, 2013 11:09 am
- Full Name: Niels Engelen
- Contact:
Re: Feature Request: Limit Allowed IP Address Sign-In for specific accounts
Hi Michael,
Clear request. We'll look into enhancements for a future release but for now I will not be able to tell when this (or a similar feature) will be available.
Clear request. We'll look into enhancements for a future release but for now I will not be able to tell when this (or a similar feature) will be available.
Personal blog: https://foonet.be
GitHub: https://github.com/nielsengelen
GitHub: https://github.com/nielsengelen
Who is online
Users browsing this forum: No registered users and 10 guests