We have web server (debian lenny, standard LAMP). We have few tools useful for server monitoring/administration with web interface (phpMyAdmin,APC opcache monitor,serverstats,phpinfo...) and we would like limit access to them only for server admins. So I created apache virtual which has allowed access from localhost only. Server admins then make SSH tunnel to server. Virtual host:
<Directory /var/www/localhost/www/> order deny,allow deny from all allow from 127.0.0.1 </Directory> <VirtualHost 127.0.0.1:80> ServerName localhost DocumentRoot /var/www/localhost/www DirectoryIndex index.html index.htm index.php </VirtualHost>
My question is - is this reasonably safe? We do not use iptables/firewall. I know I can use SSL + http authentication also/instead.