Would it be possible to add some code to restrict access to services based on IP Address? I'm using services with the Deploy module (which only works on 2.x for now). Since it's an older version, I'm concerned about security holes and figure that restricting to the IP of my other drupal server would provide a good layer of security.

Note: I'm willing to just hard code this in the module code itself, but I'm not sure where it would fit best. Any hints as to where to place such a check?

Comments

marcingy’s picture

marcingy commented
Status: Active » Closed (won't fix)

6.x.2 is no longer supported - but this might help you? http://drupal.org/node/623128

solomonson’s picture

solomonson commented

Thank you very much for the tip. I just thought of an easier way to protect the services. I just edited the config file for my web server to not allow traffic outside of my other server's address for /services:

lighttpd.conf:

#Only allow services to my host
$HTTP["remoteip"] != "1.2.3.4" {
        url.rewrite-once = ( "^/services/" => "/404.html" )
}

Is this enough to block ALL services traffic? Are there other URL's I should be blocking?