2

We have servers at an ISP and a firewall in place. At our main office, we have a VPN. For an added layer of security, I'm thinking a good model may be to have developers connect to the corporate VPN and then only allow traffic in to the servers through the firewall from the VPN's IP.

My questions:

1) Does this sound like a sound method for connection?

2) What is the best method for validating user at VPN? I've used a cryptocard in a previous environment, but I'm not real familiar with the technology or competitors.

Thanks, D

3
  • This question is appropriate for ServerFault.com and has already been answered there. Please go review this similar questions there and if you have further questions please ask them on that site. Mar 3, 2012 at 18:03
  • I posted there as noted below. I started here since it was web development related. The problem with some questions is they relate to web, programing and server sometimes. It's a shame I have to fear down grade when posting b/c everyone thinks something belongs somewhere else. IMO anyhow.
    – digit1001
    Mar 5, 2012 at 9:27
  • Usually, you won't get downgraded for a question just being off topic. However, the system isn't perfect. Please do not feel discouraged though. Down votes affect you vastly less than up votes. Also, it is best practice to ask your question on 1 site and see what answers you get before creating a duplicate on another site. If you are unsure which site is the best one to answer it and the FAQ does not even help then pick the site you think is best and then flag your question asking a moderator to review and migrate if necessary. Mar 5, 2012 at 13:23

2 Answers 2

3

Asked on Server Fault. The response was having individual users with named accounts was probably enough and that VPN access would give extra protection but may not be necessary.

1
  • Sounds about right, I've spent too many days unable to work because there is an unknown problem with the VPN - if you want/need to have tele-workers then it's a perfect solution but as I said it's a single critical point of failure. Feb 29, 2012 at 18:08
1

It's a valid model but I would be wary of doing it this way.

You place your ability to connect to the server in the hands of your VPN provider (even the best providers are never that good) and introduce a single point of critical failure with no available fail-over.

4
  • Valid point. I'm more concerned with access to the servers. Is there a better method that would provide both secure access AND failover? Right now if someone was able to get a valid user/pass they could connect via ssh/sftp. By going through VPN they'd have to get the user/pass there first, THEN also have the ssh info... Thanks!
    – digit1001
    Feb 27, 2012 at 20:51
  • Fair point, you could restrict the ip range allowed to connect? Feb 27, 2012 at 20:54
  • Have you asked on server fault? They may have a more useful point of view... Feb 27, 2012 at 20:55
  • I didn't and wasn't sure where it belonged... thought they may move it here.
    – digit1001
    Feb 27, 2012 at 21:12

Not the answer you're looking for? Browse other questions tagged or ask your own question.