You can write a small custom extension that checks if the user has permission to access the site.
Your config.xml
would look something like this
<?xml version="1.0"?>
<config>
<modules>
<[Namespace]_[Module]>
<version>1.0.0</version>
</[Namespace]_[Module]>
</modules>
<global>
<models>
<[module]>
<class>[Namespace]_[Module]_Model</class>
</[module]>
</models>
<events>
<controller_front_init_before>
<observers>
<[namespace]_[module]_access_observer>
<type>singleton</type>
<class>[Namespace]_[Module]_Model_Observer</class>
<method>checkAccess</method>
</[namespace]_[module]_access_observer>
</observers>
</controller_front_init_before>
</events>
</global>
</config>
And your observer class something like this
class [Namespace]_[Module]_Model_Observer
{
public function checkAccess()
{
$adminurl = (string)Mage::getConfig()->getNode('admin/routers/adminhtml/args/frontName');
$urlstring = Mage::helper('core/url')->getCurrentUrl();
$url = Mage::getSingleton('core/url')->parseUrl($urlstring);
if (strstr($url->path, "/{$adminurl}")) return $this; // this is the admin section
// get admin session
Mage::getSingleton('core/session', array('name' => 'adminhtml'))->start();
$admin_logged_in = Mage::getSingleton('admin/session', array('name' => 'adminhtml'))->isLoggedIn();
// return to frontend section
Mage::getSingleton('core/session', array('name' => 'frontend'))->start();
if (!$admin_logged_in)
{
die('No access!');
}
}
}