3

I have started working on a new website, I would like to put it on the server such that some people could see it but not publicly available. I put it on the server and removed the DNS record on the server, and edit the .hosts file on machine which need access to this site. May I ask is this a good implementation and any compromise? Thanks!

0

4 Answers 4

2

Your solution above would only sort of hide your server. The IP address would still be accessible to the world. It also wouldn't remain hidden for long, since automated port scans (such things are just background noise on the internet) will pick it up pretty quickly. In fact, I wouldn't be surprised if Google had it indexed within a week... To be clear: It should not be considered a meaningful security measure.

The password setup given above is your best route. You can also restrict access based on the IP address of the clients ( http://httpd.apache.org/docs/2.2/mod/mod_authz_host.html ). This is only useful if you know that the authorized people will be coming from predictable locations; and should be used in tandem with passwords, rather than instead of them.

2
  • I have followed this cloudsites.rackspacecloud.com/index.php/… to create a .htaccess and .htpasswd, would I need a php login page?
    – Terry
    Dec 8, 2010 at 12:50
  • No. The request for Basic Auth is something sent by the server to the browser. All browsers know how to handle that request and typically present a login box. Once a user logs in, they stay logged in for as long as the browser is open. (Once given, the browser will automatically send the username and password with every subsequent request and then 'forgets' them when you close it.) Dec 8, 2010 at 13:30
6

Use HTTP (basic/db/digest) authentication (Apache: http://httpd.apache.org/docs/2.2/mod/mod_auth_basic.html, IIS: http://msdn.microsoft.com/en-us/library/aa292114%28VS.71%29.aspx, etc)

2
  • What exactly does it authenticate with? thanks!
    – Terry
    Dec 8, 2010 at 11:43
  • With whatever you configure or program.
    – TomTom
    Dec 8, 2010 at 12:14
3

for apache : How do I password protect an Apache website?

0

Most of the options provided are correct but you could hide it in plain sight if you don't have anything sensitive.

Don't put a sitemap and don't link any other page to the landing page. This way no crawler would be able to crawl your site and unless the person accessing your site knew the exact URL, he wouldn't know how to get there.

When doing this don't name your landing page index.{html,php,py.pl}

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .