0

I posted on webmasters, but someone suggested I ask here...

https://webmasters.stackexchange.com/questions/26517/securing-access-to-server

We have developers who work remotely and servers at an ISP. I'm trying to determine the best security model for accessing the servers. Currently users login with SSH or SFTP to manage files or connect. The servers are behind a firewall that blocks ports but is not restricting IPs b/c a developer may work at different locations or from home where IPs change.

My thought was to have all developers connect to a corporate VPN that's set up, then have the VPN make the connection to the servers through the firewall. I could block all IPs other than the VPN this way.

Is that a "standard" way to add security?

2
  • 1
    It is worth noting that the other "best practice" consideration is whether the developers have appropriate separation of development, test, and production environments. Far too often, web developers are doing development and testing in the production environment, either because they don't have appropriate tools and source control in place to do it right, or because they simply don't know any better.
    – Skyhawk
    Feb 28, 2012 at 16:58
  • Currently dev and prod with separate coding/db environments. Testing is in dev, which limits us to finish debugging before moving on to the next piece. Working on getting a test area up so we can finish "A", move to test, then work on "B" while "A" is being tested...
    – Don
    Feb 28, 2012 at 19:04

1 Answer 1

1

Well the "standard" way would be for each developer to have their own login id and credential set. Have a password policy that forces strong passwords, and a logging mechanism to determine who logged in, who change what, and when. You are already enforcing secure communications channels so thats are great start.

You could go the extra step of having the users VPN to a host, then have a firewall rule that only allowed connections to the web pool from conection originating from the VPN host, but I'm not sure that is necessary if the other policies above are in place and enforced.

1
  • The first part IS in place. 3 users with separate login/passwords for SSH/SFTP. Only one user and company pres have root access so any account can be removed at any time. I'm putting together a security policy and wondered if this would be considered "good enough" to most other IT shops. Thanks.
    – Don
    Feb 28, 2012 at 18:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .