What tools or techniques do you use to check if your server is really secure?
As an administrator you spend quite some time to secure your server but how do you actually know if it really is? Let's say you have a webserver thus port 80 would be open. Also a vpn service so you can secure connect to the server.
So apart from a simple port scan how do you test the security of your server?
I've got a new virtual Windows 2003 Server hosted. I would like to be able to connect to the server using a VPN connection so I don't need to open up ports for subversion, ftp and so on to the public.
My goal is to only have port 80/443 open and all the other services (source control, build server, ftp server) are only accessible via a VPN connection to the server.
Now, the tricky bit (I think) is that I only have one network card and one public IP address. Is it possible at all or do I need at least two IP addresses?
[UPDATE]
I also would like to use the build in VPN server, no 3rd party software.