Our servers are configured to have all internet access blocked unless specifically whitelisted.
I recently setup DUO proxy. We already had access to our our API link whitelisted, https://■■■■■■■■■■■■■■■■■■■■■■■■■■■■ but DUO proxy wouldn’t work correctly.
When we debugged it, it appeared that DUO Proxy was also accessing ‘https://52.19.127.194’. When we whitelisted that, the proxy worked fine.
What I don’t understand is why it was using a fixed IP in a URL. The reverse DNS just points to amazon web services. I did some searching and found that at least a couple of duosecurity subdomains point to that IP. We are constantly told not to use IPs for whitelisting because IPs can change at any time and I am worried that exactly this will happen and break our DUO proxy when it does.
I suspect the DUO Proxy software is doing a domain lookup to get the IP but rather than use the domain in the web request it is making, it is inserting its own lookup request result IP into the web request it is making.
Why is it doing this? Why is it requesting https://52.19.127.194 rather than https://blah.duosecurity.com? How long before the IP changes and my whitelisting gets broken?!
