Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a staging server and production server that hosts multiple sites (using Apache2.2). Currently, I have the DNS pointing stage.domainX.com to the staging server and *.domainX.com pointing to the production server.

Everything seems to be working pretty good, but I would like to be able to secure the access to the staging server. So, unless it is the right person, someone trying to enter stage.domainX.com should be disallowed (and, if possible, go to the production server).

And, I wanted to use a domain name instead of an IP because I want the clients to be able to more friendly view the staging site (instead of memorizing an IP address).

Is there a good way to handle this? Or, am I handling the staging domain name process in an unusual way?

P.S. I've actually wanted to manage this through ports, but I haven't figured out a way to do it. Like, domainX.com:80 (standard) goes to production and domainX.com:9000 goes to staging. Haven't found a way to do this in DNS though (using GoDaddy's nameservers/zones).

share|improve this question
add comment

2 Answers 2

up vote 2 down vote accepted

Using Apache you can simply set up your staging server's Allow and Deny directives to restrict access to authorized IP addresses. Alternatively you can put the entire thing behind HTTP Authentication (username/password, or client certificates if you want to get really fancy).
Bonus points for using a custom "unauthorized" error page to redirect people to the production site .

Configuring Apache to serve the staging site on a different port is also an option, but this is just "security through obscurity" like using the stage.domainX.com domain -- it doesn't stop anyone from finding the staging site if they go looking.

<rant>
Note that changing the port IS NOT something you do with DNS - it's a webserver configuration thing (See the Apache manual for details). DNS has NO CONCEPT of port numbers, it's just a name-to-IP (or IP-to-name) mapping* -- pet peeve.
* There are some limited exceptions, like SRV records, but we're talking about Address and CNAME records
</rant>

share|improve this answer
    
Thanks for the help. Right, DNS does not handle ports - that makes sense. But, that means every instance of domainX.com:<port> will go to the same server. How do you configure a domain to go to different physical servers (not just vhosts) based on the port used? –  Stephen Watkins Mar 31 '11 at 16:07
    
@Steve two real options -- run two copies of your web stack (Apache all the way on down through your database) on different ports, or put in a load-balancer box that does the actual listening (and redirects to the appropriate real machine based on port) -- Honestly a staging domain with access control is probably better, especially if you're smart enough to use two separate servers :) –  voretaq7 Mar 31 '11 at 16:26
add comment

I've used an Apache setup like the following successfully in the past; it allows certain listed IP-addresses to freely access the staging site without supplying Basic-Authentication credentials (e.g. you could add the IP-addresses of your-office and your-client's-office), but still allows for password-based access if the client is out-of-office, for example.

# Set NOAUTH environment-variable for certain IPs that are allowed without credentials
SetEnvIf Remote_Addr 11.22.33.44 NOAUTH=1

# Staging
<VirtualHost *:80>
    ServerName    stage.domainX.com
    DocumentRoot  /var/www/stage.domainX.com

    # Access restrictions
    <Location />
        Order allow,deny
        # Anyone with the NOAUTH environment variable is allowed
        Allow from env=NOAUTH

        # Anyone that has valid credentials is allowed
        AuthType      Basic
        AuthName      "DomainX Staging"
        AuthUserFile  /etc/apache2/staging.domainX.com.passwd
        Require valid-user

        # Either of the above is fine
        Satisfy Any
    </Location>

    # ... other directives ...
</VirtualHost>

# Production
<VirtualHost *:80>
    ServerName    domainX.com
    DocumentRoot  /var/www/domainX.com

    # ... other directives ...
</VirtualHost>
share|improve this answer
    
Thanks - this worked great. Note to anyone who tries to use this... create a password file with htpasswd command. –  ServAce85 Nov 22 '11 at 14:49
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.