Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I posted on webmasters, but someone suggested I ask here...

We have developers who work remotely and servers at an ISP. I'm trying to determine the best security model for accessing the servers. Currently users login with SSH or SFTP to manage files or connect. The servers are behind a firewall that blocks ports but is not restricting IPs b/c a developer may work at different locations or from home where IPs change.

My thought was to have all developers connect to a corporate VPN that's set up, then have the VPN make the connection to the servers through the firewall. I could block all IPs other than the VPN this way.

Is that a "standard" way to add security?

share|improve this question
It is worth noting that the other "best practice" consideration is whether the developers have appropriate separation of development, test, and production environments. Far too often, web developers are doing development and testing in the production environment, either because they don't have appropriate tools and source control in place to do it right, or because they simply don't know any better. – Skyhawk Feb 28 '12 at 16:58
Currently dev and prod with separate coding/db environments. Testing is in dev, which limits us to finish debugging before moving on to the next piece. Working on getting a test area up so we can finish "A", move to test, then work on "B" while "A" is being tested... – Don Feb 28 '12 at 19:04
up vote 1 down vote accepted

Well the "standard" way would be for each developer to have their own login id and credential set. Have a password policy that forces strong passwords, and a logging mechanism to determine who logged in, who change what, and when. You are already enforcing secure communications channels so thats are great start.

You could go the extra step of having the users VPN to a host, then have a firewall rule that only allowed connections to the web pool from conection originating from the VPN host, but I'm not sure that is necessary if the other policies above are in place and enforced.

share|improve this answer
The first part IS in place. 3 users with separate login/passwords for SSH/SFTP. Only one user and company pres have root access so any account can be removed at any time. I'm putting together a security policy and wondered if this would be considered "good enough" to most other IT shops. Thanks. – Don Feb 28 '12 at 18:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.