Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

It has been suggested that the admin section of a custom CMS we use require VPN access to reach. How feasible is this? The site has a front end http://thesite.com and a backend http://thesite.com/admin so how feasible is it to set things up so that anyone accessing the admin areas has to log in via VPN?

I have some experience in setting up an openvpn server (under Ubuntu... this one is under CentOS) but that was for use as a secure proxy for access from remote locations (i.e. fire up the laptop, login to the VPN and surf securely). This situation is different as, in an effort to help secure a too frequently hacked site, the owner has decided a VPN is the solution.

So, is this doable? Completely the wrong direction? We are working on securing this mess of code (and have closed some vulnerabilities) but in the meantime... suggestions/tips/links?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

"Doable" by limiting admin applications/access to either local net, loop-back or same IP/net (depending on your specific configuration and requirements), so that the "from" IP will only match those conditions when it is through the VPN.

share|improve this answer
    
Hey, thanks for the reply. I'm not totally clear on what you mean so let me paraphrase... it is doable if the IP of the person accessing the admin section matches a local IP or is part of the same IP? Like 192.168.1.103 or some such relating to local or if the IP is 68.123.12.123 the IP of the person accessing would need to also come from 68.123.12.xxx? –  Lothar_Grimpsenbacher Oct 12 '10 at 18:47
    
Depending on the actual VPN solution you wind up utilizing, the connecting IP will either be assigned by the VPN server or actually assume that IP of the VPN server with most solutions. –  user48838 Oct 13 '10 at 6:05
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.