Tell me more ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.
up vote 2 down vote favorite

We have servers at an ISP and a firewall in place. At our main office, we have a VPN. For an added layer of security, I'm thinking a good model may be to have developers connect to the corporate VPN and then only allow traffic in to the servers through the firewall from the VPN's IP.

My questions:

1) Does this sound like a sound method for connection?

2) What is the best method for validating user at VPN? I've used a cryptocard in a previous environment, but I'm not real familiar with the technology or competitors.

Thanks, D

share|improve this question
This question is appropriate for ServerFault.com and has already been answered there. Please go review this similar questions there and if you have further questions please ask them on that site. – RandomBen Mar 3 '12 at 18:03
I posted there as noted below. I started here since it was web development related. The problem with some questions is they relate to web, programing and server sometimes. It's a shame I have to fear down grade when posting b/c everyone thinks something belongs somewhere else. IMO anyhow. – digit1001 Mar 5 '12 at 9:27
Usually, you won't get downgraded for a question just being off topic. However, the system isn't perfect. Please do not feel discouraged though. Down votes affect you vastly less than up votes. Also, it is best practice to ask your question on 1 site and see what answers you get before creating a duplicate on another site. If you are unsure which site is the best one to answer it and the FAQ does not even help then pick the site you think is best and then flag your question asking a moderator to review and migrate if necessary. – RandomBen Mar 5 '12 at 13:23

closed as off topic by RandomBen Mar 3 '12 at 18:03

Questions on Webmasters Stack Exchange are expected to relate to webmastering within the scope defined in the FAQ. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about closed questions here.

2 Answers

up vote 2 down vote

Asked on Server Fault. The response was having individual users with named accounts was probably enough and that VPN access would give extra protection but may not be necessary.

share|improve this answer
Sounds about right, I've spent too many days unable to work because there is an unknown problem with the VPN - if you want/need to have tele-workers then it's a perfect solution but as I said it's a single critical point of failure. – toomanyairmiles Feb 29 '12 at 18:08
up vote 1 down vote

It's a valid model but I would be wary of doing it this way.

You place your ability to connect to the server in the hands of your VPN provider (even the best providers are never that good) and introduce a single point of critical failure with no available fail-over.

share|improve this answer
Valid point. I'm more concerned with access to the servers. Is there a better method that would provide both secure access AND failover? Right now if someone was able to get a valid user/pass they could connect via ssh/sftp. By going through VPN they'd have to get the user/pass there first, THEN also have the ssh info... Thanks! – digit1001 Feb 27 '12 at 20:51
Fair point, you could restrict the ip range allowed to connect? – toomanyairmiles Feb 27 '12 at 20:54
Have you asked on server fault? They may have a more useful point of view... – toomanyairmiles Feb 27 '12 at 20:55
I didn't and wasn't sure where it belonged... thought they may move it here. – digit1001 Feb 27 '12 at 21:12

Not the answer you're looking for? Browse other questions tagged or ask your own question.