I am looking for a way to configuire a development webserver. My main goal is to be able to provide internal personel with access to these development websites for review and testing? I'm not sure if its possible to configuire something that would allow for the existence of urls such as dev.someprojectname.com that could only be accessed interanlly. I'm not sure if I need to have entries put into a domain controller or if there is a simple way of implementing this.
Add a comment
|
3 Answers
It can be configured just like any other IIS web server, except use a domain name local to your network (dev.mycompany.local) or some other DNS name that exists only for your local network. If it needs to be accessible from the outside, use a standard domain name that will resolve externally, and disable anonymous access to the site in the IIS web site properties (use Integrated Windows authentication if possible). Then, your developers can use their domain accounts and passwords to authenticate when they first access a dev site and use it normally from that point forward.
answered May 7, 2009 at 23:32
-
Thank you for you suggestion I will consult with our network admin and see about implementing this as a possible solution. May 7, 2009 at 23:45
-
Note that "some...DNS name that exists only for your local network" is not a security solution - if the IP address is accessible, it will be found, DNS or no. AAMOF, a standard domain name that resolves to a non-routable/firewalled address works just as well. .local is to avoid DNS conflicts, not for security. May 8, 2009 at 0:15
-
Good comment Mark, I was going on the assumption that if it's a server on the local network with a local domain name, it would likely be on an internal IP and not routable to the outside world. If they used a public DNS name, then it would point to an external public address and have port forwarding on the NAT router to bring the requests into the network. May 8, 2009 at 0:28
It's just like a production web server, only with different security. If you want it internal only (meaning, you must be on the internal LAN to access it) give it a private IP address that's not accessible from the outside (or block it at the firewall).
If you'd like to expose it more than that, you can use IIS authentication - but I don't recommend it. Dev sites are likely misconfigured, with wide open security holes.
So, if you're going to expose it outside of your trusted LAN, stick a reverse proxy server in front. The proxy is a production server, and handles authentication (with some combination of ip address, username/password, and/or client cert). The dev server still sits on a private IP address, and the firewall only lets the proxy server access it.
If it's for local use only and you can't get entries added to DNS you and your colleagues can also have a play with your hosts file to configure some new uris.
