Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a staging server and production server that hosts multiple sites (using Apache2.2). Currently, I have the DNS pointing to the staging server and * pointing to the production server.

Everything seems to be working pretty good, but I would like to be able to secure the access to the staging server. So, unless it is the right person, someone trying to enter should be disallowed (and, if possible, go to the production server).

And, I wanted to use a domain name instead of an IP because I want the clients to be able to more friendly view the staging site (instead of memorizing an IP address).

Is there a good way to handle this? Or, am I handling the staging domain name process in an unusual way?

P.S. I've actually wanted to manage this through ports, but I haven't figured out a way to do it. Like, (standard) goes to production and goes to staging. Haven't found a way to do this in DNS though (using GoDaddy's nameservers/zones).

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Using Apache you can simply set up your staging server's Allow and Deny directives to restrict access to authorized IP addresses. Alternatively you can put the entire thing behind HTTP Authentication (username/password, or client certificates if you want to get really fancy).
Bonus points for using a custom "unauthorized" error page to redirect people to the production site .

Configuring Apache to serve the staging site on a different port is also an option, but this is just "security through obscurity" like using the domain -- it doesn't stop anyone from finding the staging site if they go looking.

Note that changing the port IS NOT something you do with DNS - it's a webserver configuration thing (See the Apache manual for details). DNS has NO CONCEPT of port numbers, it's just a name-to-IP (or IP-to-name) mapping* -- pet peeve.
* There are some limited exceptions, like SRV records, but we're talking about Address and CNAME records

share|improve this answer
Thanks for the help. Right, DNS does not handle ports - that makes sense. But, that means every instance of<port> will go to the same server. How do you configure a domain to go to different physical servers (not just vhosts) based on the port used? – Stephen Watkins Mar 31 '11 at 16:07
@Steve two real options -- run two copies of your web stack (Apache all the way on down through your database) on different ports, or put in a load-balancer box that does the actual listening (and redirects to the appropriate real machine based on port) -- Honestly a staging domain with access control is probably better, especially if you're smart enough to use two separate servers :) – voretaq7 Mar 31 '11 at 16:26

I've used an Apache setup like the following successfully in the past; it allows certain listed IP-addresses to freely access the staging site without supplying Basic-Authentication credentials (e.g. you could add the IP-addresses of your-office and your-client's-office), but still allows for password-based access if the client is out-of-office, for example.

# Set NOAUTH environment-variable for certain IPs that are allowed without credentials
SetEnvIf Remote_Addr NOAUTH=1

# Staging
<VirtualHost *:80>
    DocumentRoot  /var/www/

    # Access restrictions
    <Location />
        Order allow,deny
        # Anyone with the NOAUTH environment variable is allowed
        Allow from env=NOAUTH

        # Anyone that has valid credentials is allowed
        AuthType      Basic
        AuthName      "DomainX Staging"
        AuthUserFile  /etc/apache2/
        Require valid-user

        # Either of the above is fine
        Satisfy Any

    # ... other directives ...

# Production
<VirtualHost *:80>
    DocumentRoot  /var/www/

    # ... other directives ...
share|improve this answer
Thanks - this worked great. Note to anyone who tries to use this... create a password file with htpasswd command. – ServAce85 Nov 22 '11 at 14:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.