Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have started working on a new website, I would like to put it on the server such that some people could see it but not publicly available. I put it on the server and removed the DNS record on the server, and edit the .hosts file on machine which need access to this site. May I ask is this a good implementation and any compromise? Thanks!

share|improve this question
    
Is there any compromise with this setup tho? –  Terry Dec 8 '10 at 11:51

4 Answers 4

up vote 2 down vote accepted

Your solution above would only sort of hide your server. The IP address would still be accessible to the world. It also wouldn't remain hidden for long, since automated port scans (such things are just background noise on the internet) will pick it up pretty quickly. In fact, I wouldn't be surprised if Google had it indexed within a week... To be clear: It should not be considered a meaningful security measure.

The password setup given above is your best route. You can also restrict access based on the IP address of the clients ( http://httpd.apache.org/docs/2.2/mod/mod_authz_host.html ). This is only useful if you know that the authorized people will be coming from predictable locations; and should be used in tandem with passwords, rather than instead of them.

share|improve this answer
    
I have followed this cloudsites.rackspacecloud.com/index.php/… to create a .htaccess and .htpasswd, would I need a php login page? –  Terry Dec 8 '10 at 12:50
    
No. The request for Basic Auth is something sent by the server to the browser. All browsers know how to handle that request and typically present a login box. Once a user logs in, they stay logged in for as long as the browser is open. (Once given, the browser will automatically send the username and password with every subsequent request and then 'forgets' them when you close it.) –  SmallClanger Dec 8 '10 at 13:30

Use HTTP (basic/db/digest) authentication (Apache: http://httpd.apache.org/docs/2.2/mod/mod_auth_basic.html, IIS: http://msdn.microsoft.com/en-us/library/aa292114%28VS.71%29.aspx, etc)

share|improve this answer
    
What exactly does it authenticate with? thanks! –  Terry Dec 8 '10 at 11:43
    
With whatever you configure or program. –  TomTom Dec 8 '10 at 12:14

Most of the options provided are correct but you could hide it in plain sight if you don't have anything sensitive.

Don't put a sitemap and don't link any other page to the landing page. This way no crawler would be able to crawl your site and unless the person accessing your site knew the exact URL, he wouldn't know how to get there.

When doing this don't name your landing page index.{html,php,py.pl}

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.