SessionCheckRemoteIP

[GLM]

Hi,

OTRS 6.

The documentation states that the parameter SessionCheckRemoteIP turns on the remote ip address check, but can't find a good explanation about what the remote ip address check is used for. Also I want to know what security implications arises from disabling the remote ip address check.

Thank you.

[wurzel]

Hi,

I could think of faking IP addresses and taking over sessions. Usually it is not disabled.


on clusters or with dial up connections you might think of disabling it.

Flo

[zzz]

Hello,

The SessionCheckRemoteIP makes sure that a session is bound to a single IP address (the IP which created the session).

Advantages: It's harder to steal a session.
That would normally require a non secure connection or access to the PC/Phone/Tablet, but I guess in that case you'd have other problems ...

Disadvantages: Your users will have a hard time if they work outside of a static IP. Some examples:
- mobile phones, which frequently change IPs or keep switching between WIFI/5G/LTE/3G
- they are working within a proxy farm
- they are using a non company VPN
- they work from home without a static IP (that normally happens at night and is only to consider if you also increased the keep-alive time of a session)

Best regards
Emin