I have a Windows 2008 Amazon EC2 instance with a public facing web site and a back office 'Admin' site. Currently the back office site is secured with username / password, but ideally I'd like to add an additional layer of security such as access only via VPN.
As far as I can tell the Amazon VPC VPN solution is hardware based. Users accessing the back office site will be doing so from different geographic locations and from dynamic IPs. This seems to mean that Amazon VPC VPN or security based on client IP is out.
Would a software VPN solution be possible. Can anyone recommend one? I also looked into setting up an SSH server, using SSH tunnelling + port forwarding, and running the Admin site on a port > 80. Would anyone recommend that as an option?
On the other hand, am I being too cautious, as long as the admin site login is secure and user's passwords are strong?