#Using access in mac websites manual
#Using access in mac websites software
#Using access in mac websites password

#Using access in mac websites password

Once the user authenticates on the webserver, then you would send them a message, either via SMS or e-mail that contains a single-use or one-time password that allows the user to be whitelisted for some set amount of time on the server. The password should be at least 16 characters. Next you'll need to run SSL on the webserver and require a specific username and password for the user. So that 'locks down' the access to the actual web server. the ip address lists would need to be updated on the internal DHCP server

#Using access in mac websites software

If you use a corporate after market software firewall like Kaspersky (on a Windows or Linux box) you can block traffic that way too.ДЎ. Then on the web server itself you can restrict access to the website via the whitelisted ip addresses ( IIS 7 and Apache) you've setup in the DHCP server and in the local firewall (this is redundant in the event someone finds an exploit for altering iptables in a *Nix box). This would include the VPN range assigned in the router for the users and the whitelisted internal static IP addresses. On the firewall on the webserver you would setup a subnet of addresses that can connect to the web server. This will help you check for collisions and spoofed IP addresses and MAC addresses. Local traffic should have static IP addresses assigned by MAC address (spoofable) by the DHCP server which are all logged. Local traffic and VPN traffic would need to have different IP ranges for tracking. Because you can't control the network on the other end of the VPN (let's say the user's home network) then this is a potential attack vector. Depending on the router you can assign rules. Once you've authenticated via VPN (remotely) you would assign a local IP address within a certain specified range (this depends on the number of clients connecting to the server). Cisco has apps for iPads that can be used to setup a 'secure' tunnel with the router. Setup an SSL VPN firewall (Cisco comes to mind). If the server is used for other sites they should be on a different server or VM. Do NOT use NAT to connect any outside traffic to the webserver. Setup the web server on a physical server on the office LAN. These are a few steps you can take to try and harden the system: As Rook said, there are still things here than can be exploited. This is probably as 'secure' as you can make it. If all your customer is looking for is to stop people from outwith the company seeing their site, I'd go with the source IP address filter approach. Create a list of devices and their finger print, then if the client cert is used on a device which doesn't match the fingerprint you can block it.ДЄs I say these aren't absolutes but then nothing in security is.

perhaps as a detective control you could combine this with browser fingerprinting (e.g.

As points out it may be possible to move those to another machine but that would require the attacker to either be a staff member of to have unuthorised access to one of their systems

You could also use client Certificates on authorised devices.

TBH this sounds like the approach that will work best for your customers requirement Most companies will have static IP addresses on their Internet facing routers and if you set the application only to be accessible by those IP addresses it would be harder for an unauthorised person to get access to it unless he is in their office.

Setup a firewall in front of the application to restrict the IP addresses allowed to access the application to the clients external IP address range.

I'm pretty sure the LaunchAgent/LaunchDaemons were the only thing that caused problems.There's a couple of things you can do to help restrict the use of the application to a specific office location and specific devices, although as other answers point out none of them are absolute protection

plist files from both /Library/LaunchAgents and /Library/LaunchDaemons.ДЄfter computer restart I successfully connected to the Internet! I removed both applications (there is no need in them for me at the moment) and also removed their. Also, there were files from Team Viewer and Windscribe VPN. plist files from Google Chrome, Microsoft Teams, etc. Then I looked into /Library/LaunchAgents and /Library/LaunchDaemons. I removed 2 suspicious files from ~/Library/LaunchAgents.

removing files from /Library/Preferences/System Configuration.

#Using access in mac websites manual

renew DHCP lease / use of manual IP-address.

remove all networks from Network > Advanced.

connect to working Wi-Fi that worked on other devices.

I cannot ping any host on the Internet (1.1.1.1, etc).

I can ping my router and all arp table (there were only 3 records).