Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have some staging and development web servers on cloud hosting. I do not want them to be accessible to the general public. It's easy enough to restrict access by network or authentication.

The problem is that there are many times where I want third parties to have access, so they can preview changes before they go into production. It would be too much to ask these third parties to configure VPN clients or to create user accounts for all of them. It's ok if it's a little bit less convenient than just sending them a link in an e-mail, but too much would be a problem.

Is there a best practice for this scenario? If so, what is it? I feel like I'm asking how I can have my cake and eat it to, so I completely understand if you tell me it's not possible.

share|improve this question
up vote 1 down vote accepted

In these situations, I've usually gone with a HTTP Basic auth over the site with a shared username/password (one set of credentials per site, if you're doing lots at once). Since you're not really worried about who exactly is logging in, you don't need a login per user, and instead just need something to "keep the riffraff out", which, if you can trust whoever's coming to the site not to tweet the credentials you give them, should be satisfied by a simple shared username/password.

share|improve this answer
This also keeps development and staging URLs out of search engines. – Gerald Combs Jul 18 '11 at 23:37
Yeah, I was thinking this. I think I'm going to use HTTP Basic Auth, but automatically allow anyone coming from our office network to bypass it, if that is possible. – Apreche Jul 19 '11 at 3:02
That is possible; I'm sure it's in the apache docs somewhere, otherwise... ask on Server Fault! – womble Jul 19 '11 at 3:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.