Question

With Elmah installed on our dev web server .. can we restrict who remotely accesses it? Even f we hardcode the username/passwords (hashed?) or is it only via IP?

Answer 1

There are two settings, one is in <elmah>:

<elmah>
    <security allowRemoteAccess="1"/>
</elmah>

The other is, if you allow remote access, you can use the <location> to control who accesses it:

  <location path="elmah.axd">
    <system.web>
      <authorization>
        <allow roles="Administrator"/>
        <deny users="*"/>
      </authorization>
    </system.web>
  </location>

You can put this in the main web.config just after you </runtime> tag