0

I have now a working Website that I have deployed to the IIS on my local machine using Visual Studio 2013. I can access the website successfully from other machines in my office and in neighboring offices. I have even had others check the access from geographically remote locations, and still been successful. The access method is to put my machine's IP Address and add the name of the application, ###.###.###.###\name, into the address bar of a browser.

The next step is to promote it to production. We are not using Azure, so the tutorials for promotion to production I have found aren't useful, nor are we using 3rd party providers.

The method I have conceived is as follows:

  • Have an admin directly login into a company server
    • install the database software
    • install Visual Studio
    • install IIS
    • copy the local machine's db to the server db
    • copy the locally deployed files to the server

  • admin login into Visual Studio

    • deploy the site on the server in the same way it was deployed on the local machine

  • use the server IP or update the host file on all networked computers to map the IP to an appropriate name (or the local network has a local DNS we can update)

This would allow me a DEV environment (the VS IDE), a TEST env (locally deployed version), and a PROD env (the version deployed on the server).

I don't see any reasons why this wouldn't work, maybe a bit tedious, but workable.

Is this method ok? Am I missing anything critical?

wolfsshield
  • 757
  • 5
  • 14
  • This isn't a StackOverflow type question. https://serverfault.com/ may be a better fit for this type of question. – bob0the0mighty Mar 13 '19 at 20:28
  • @bob0the0mighty I've posted it there. I've deleted one question with an answer on it at the suggestion of one of the commentators for that question, and it gave me a warning that frequent deletions of questions with answers may bar me from asking more questions. Shall I just let the admin remove this question, or ask TempScripter below to remove his answer first and delete the question myself? – wolfsshield Mar 13 '19 at 20:52
  • My understanding is that leaving it should be fine and If a mod thinks it should be removed now that it has answers they'll take care of it. – bob0the0mighty Mar 14 '19 at 14:31

2 Answers2

0

Dont Put Yours Machine IP, Decompilers Can Take It And BruteForce Your IP To Remote Acess Your Machine.

TempScripter
  • 1
  • 2
  • How much of a threat is that if the only ones with access to the intranet are company internal and the IP is a "local" ipv4 IP address? – wolfsshield Mar 13 '19 at 19:59
0

No, this is an altogether inappropriate way to push a build to a production environment.

Your source code should be stored in a source code repository. You should have an automated, continuous build server pull from the repository and complete the build in a dedicated environment that is itself under change control. The build should include the generation of installation files, e.g. a click-once deployment package. From there you can have an admin run the deployment package, or, ideally, you'd push it automatically with a tool like Octopus.

The above, honestly, is the bare minimum for a commercial web site. There is much, much more you can do to make things even more robust, e.g. blue-green deployment.

Note that none of this involves installing development tools like Visual Studio on your server. The server should stay as clean as possible, running the fewest applications that you need, to minimize any sort of attack surface and to keep the machine running efficiently.

John Wu
  • 50,556
  • 8
  • 44
  • 80
  • I've looked deeper into the capabilities of VisualStudio 2013 as a result of your answer. If I have IIS installed on the server as well as Web Deploy, and I can connect to the server from my desktop using the VisualStudio Publish Website wizard, would that match your click-once deployment? – wolfsshield Mar 14 '19 at 16:48
  • Presumably, either the MySQL (or other) database application is either one of your "fewest applications" or you would have it run on a distinct server, if it matters at all for a small project. – wolfsshield Mar 14 '19 at 16:53