I work for a small company that up until recently had a small number of dedicated servers hosted by a hosting company on Public IP's. To manage all of our internal websites we used SSH tunnels and apache website serving only to localhost.

Recently as we are have been expanding the amount of tunnels that we have to use is starting to get a bit crazy and we are looking for another solution. We want someone to access one server and have access to the other servers(on public IP's) over a secure connection. All servers run either Ubuntu or Debian.

What kind of solutions should we be looking at? Can we setup a VPN to improve on this setup?


You could do a lot worse than use OpenVPN in a case like this; it's pretty simple to setup (providing you can get your ahead around creating an SSL Certificate Authority, but there are lots of good writeups on that) and there's support for a lot of clients - both multiple platforms and multiple implementations.

You would need to modify all those internal websites to listen on the internal network interface, rather than just localhost, too.


You can simply use TCP wrappers and allow the "central" Server to have SSH access to all the other Servers by adding its IP to /etc/hosts.allow.

It's not that ideal in terms of security, having one box able to login into anywhere but if you consider this a "bastion" host and secure it properly it's not the end of the world.


If all you want is access to websites you would be probably better off securing access on Apache level. That's what SSL/TLS is for. Even basic authentication over SSL is pretty secure (with strong passwords). And Apache can be tuned to check client certificates.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.