Ip address filtering on valid user group : should we include the ip address of developers?

Question

Imagine if your development team were asked to develop a system. The system should only response to some particular user groups such as "Group A", "Group B" or "Boss" who are the actually users of the system.

If you receive a phone call from the user saying that the system crash upon some particular situation/parameters. You tried to reproduce the problem and discovered that you Ip was filtered because there are not any valid user groups which include you/your team. You cannot even reproduce the crash and you go to ask the caller if you can borrow his/her PC to reproduce the problem at once.

After this, would you think adding a new valid group such as "Developers" would be necessary?

Answer 1

Once you start filtering by IP address, you have to configure your network to use static IP addresses. If anyone is using DHCP clients, then your whole design is useless.

In such situations, you would be better advised to use hostnames (as from DNS) instead as these will refer to the user's terminal (assuming the user only ever connects from 1 PC and is not allowed to connect from any other).

So, adding a developers group is perfectly fine design, but you need to understand that this group will change IP addresses and potentially hostnames much more often.

It would also be advisable to add a 'back door' administrative system that bypasses this security mechanism so you can debug; or ensure that you (as a debugger) can be added to the relevant user groups as needed.

You should first try to reproduce the issue with the user's configuration though, so a mechanism for copying that so your PC has the same setup as the user's would be part of a good design (as if you can only reproduce it on the user's pc, that won't help you to debug the cause) And a comprehensive system for logging all activities as the system runs would be good too - if you had that, a huge amount of errors could be determined just by looking at a log file.

Answer 2

We have a similar Groups set up with our client. Only instead of IP ranges, our system connects with the client's active directory to grant users access to the application. We then have a Users & Groups set up screen where groups can be given access and users can be added to groups.

In our case, the user provided us with a user that they manage. We have one prod user for all developers. When the password changes, we are sent an update email and need to keep track of it.

The site admins at first granted us access when we needed it and removed it when we didn't, but has since given the developer full access. We aren't admins, but we can access everything.

So, instead of creating a group just for your dev team, asking the client to make a user that your team can use to troubleshoot issues might be the way to go.