Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a small web server running on port 80, and I'd like to allow only Google Translate to have access to it.

First I tried running dig translate.google.com and dig translate.googleusercontent.com to get the IP address for it, which returned addresses ranging from 74.125.234.74 to 74.125.234.110.

Then I opened the mentioned ports, but it did not work. Looking at iptables logs, I found Google has very different IP addresses to open the target website for translation. In a few tests they ranged from 74.125.186.40 to 74.125.187.169.

Now, what I've got so far is the following rule, that opens the door for this range:

-A INPUT -p tcp --dport 80 -m iprange --src-range 74.125.186.40-74.125.187.169 -j ACCEPT

The problems:

  1. Everytime Google tries to access the page, it uses a different IP address, and probably out of the range I mentioned previously. I'd have to try many many times to take note of all the range.
  2. I'm concerned about the security implications also, since I don't know whether all IPs in the range are safe to leave open (would they all belong to Google?)

I tried nslookup 74.125.186.40 to see if I could get a domain name for it, but it returns:

** server can't find 40.186.125.74.in-addr.arpa.: NXDOMAIN
share|improve this question
    
Why are you doing this? This sounds like a bad solution to a larger problem. –  Chris Down Nov 11 '12 at 21:10
    
I need Google Translate to serve me personal files translated in a browser window. –  Teresa e Junior Nov 11 '12 at 22:29
    
And why are you seeking to block all other traffic? What are you trying to gain? –  Chris Down Nov 11 '12 at 22:45
    
I don't think I need to allow access to the whole world if only Google Translate is to have access to my machine. Also, it is just a simple python -m SimpleHTTPServer 80 server, since I need it only for that purpose. –  Teresa e Junior Nov 11 '12 at 22:48
    
So do that appropriately, blocking everyone else is a poor method of doing this. I assume all data is being returned upon request? If so, just block everything incoming that isn't in an established or related state. That would be the appropriate way to handle it. –  Chris Down Nov 12 '12 at 2:36
show 6 more comments

1 Answer

up vote 1 down vote accepted

You can't do this effectively. You aren't going to be able to count on any particular block of IPs for any known length of time.

Now, there are a couple of ways of solving your problem.

  1. cut&paste what you need to translate into Google Translate. You can use cat file | xclip -i to do this for even a fairly long file if you have the xclip package installed.
  2. If you are using a fairly solid web server, make a directory for it to serve that has a very long and random name. Use mkdir $(dd if=/dev/random bs=21 count=1 | base64) to create the directory so it has a truly random name. Make sure you have to include that directory name in the URL. This will set it up so someone has to know a secret in order to get at any of the files. Of course, you have to make sure the parent directory cannot be listed through the web server, otherwise it's trivial to figure out what the 'secret' directory name is.
share|improve this answer
1  
Hi, @Omnifarious. I actually can't tell how safe python -m SimpleHTTPServer 80 is, but it does allow directory listing on http://myipaddress. Maybe there's some additional CLI parameter that I am unware of. Also, I was thinking, if I open the port for something like 74.125.186.0/8-74.125.187.0/8, will this range belong to Google only? If so, I think it would be safe, wouldn't it? –  Teresa e Junior Nov 12 '12 at 4:59
    
@TeresaeJunior: Do chmod a-r on the directory after you create the 'secret' directory in it. That should stop your webserver from listing that directory. Relying on the IP address mapping is just going to eventually get you in trouble, and IMHO is actually less secure than the secret directory idea. –  Omnifarious Nov 12 '12 at 19:30
    
@TeresaeJunior: You know, I would do both. The layers of protection complement each other well. Though they are both weak against an attacker in the middle. –  Omnifarious Nov 12 '12 at 19:59
    
I had a look at the documentation for SimpleHTTPServer, and I can avoid directory listing by providing an index.htm file, and it also doesn't allow parent directory listing. Thanks for your help! –  Teresa e Junior Nov 14 '12 at 1:10
    
And make sure to add a robots.txt to tell search engines not to index the site. –  Stephane Chazelas Nov 24 '12 at 21:20
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.