RE: Active Directory and IIS on production servers, and clustering

From: David LeBlanc (dleblanc_at_mindspring.com)
Date: 10/31/05

  • Next message: Jim Stagg: "RE: Active Directory and IIS on production servers, and clusterin g" 
    To: "'Jim Stagg'" <jstagg@sprich.com>, "'Focus-MS'" <focus-ms@securityfocus.com>
Date: Sun, 30 Oct 2005 15:20:53 -0800

     

    > -----Original Message-----
    > From: Jim Stagg [mailto:jstagg@sprich.com]
     
    > Our design has always been that public bastion hosts are NOT
    > domain members... ever. Our MS Services guy blessed that as
    > the Microsoft-supported position (DB in the secured network
    > with minimal access from the DMZ-based IIS server, which in
    > turn has only minimal access allowed from a less-trusted
    > network). Microsoft also specifically advises against a
    > private namespace being accessible from a public network.

    Sorry about chiming in very late - I don't check this list often. There's a
    couple of things to think about here - first is that there's always
    exceptions. For example, if there are more than two or three systems in the
    DMZ, it makes sense to have a DMZ domain just in order to be able to easily
    push policy and manage accounts. I'd suggest doing some serious hardening on
    the DC, but the drawbacks of not having the management outweigh the
    drawbacks of having a domain. So I disagree - unless the DMZ is trivially
    small, I'd recommend making them domain members, just not members of the
    internal domain.

    Next, consider the possibility of trusts to the internal domain. In most
    cases, unless there is some pressing business need to make a trust, I would
    _not_ establish a trust between the DMZ domain and the internal domain, but
    if I did, I'd make sure and use Win2k3 DCs and make it a limited trust.
    Additionally, if I had to create a trust out into the DMZ, I'd strongly
    consider making 2 DMZs so that I could watch the one with the trust very,
    very carefully.

    WRT putting IIS and a DC together, back in IIS 5.0 days, yes, that was a
    Very Bad Idea. IIS 6, OTOH, has been quite secure, and I'd say there's
    limited risk to pairing them. I would not under any circumstances make a
    publicly exposed IIS system a DC, but on my home network, I run IIS on my DC
    so I can run WSUS - so all this depends on the business case and the size of
    the network.

    We security people often get ourselves in trouble by tending towards
    absolutes and failing to consider the business case.

    -----------------------------------------------------------------------
    Insisting on perfect safety is for people who don't have the balls to live
    in the real world. Mary Shafer

    David LeBlanc - dleblanc(at)mindspring.com

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Jim Stagg: "RE: Active Directory and IIS on production servers, and clusterin g"

    Relevant Pages

    • Re: Steps to setup app allowing offsite network access using IIS Authe
      ... The first paras imply you want them to be able to _run_ a web app on an IIS server? ... Regardless of all that, one problem to look out for is that they won't have Active Directory if it's in a DMZ, so Integrated Authentication won't work, nor will Impersonation, You'd need to use plain text with SSL, nasty, and you'd need to pass the passwords as plain text if you want them to be able to start a process, unless you can get Kerberos working in the DMZ and able to pass the tickets over two hops. ... DMZ, there will be several steps involved - from compiling the application with a strong name, to setting up IIS and finally access to the application which will need to run on a server from the DMZ for our partners. ... Can anyone outline each step required to set this up on an IIS server in the network or DMZ along with the assembly requirements of the application to run on this network? ...
      (microsoft.public.vsnet.general)
    • RE: Active Directory and IIS on production servers, and clusterin g
      ... > more than two or three systems in the DMZ, ... > making them domain members, just not members of the internal domain. ... > Subject: RE: Active Directory and IIS on production servers,> and clustering ... In most cases, unless there is some pressing business> need to make a trust, I would _not_ establish a trust between> the DMZ domain and the internal domain, but if I did, I'd> make sure and use Win2k3 DCs and make it a limited trust. ...
      (Focus-Microsoft)
    • Re: DHCP Question
      ... so they have access to our network. ... Guests should be on a different Wireless access device, ... firewalls have more than one DMZ (and I'm not talking about the FAKE DMZ ... Trust yourself. ...
      (microsoft.public.windows.server.general)
    • Re: Forest Trust between Production & DMZ
      ... >> more vulnerable, external, then we are speaking of the trust ... If your DMZ gets whacked, ... To avoid the Swiss-cheese affect on the firewall, ... > Network segregation was a good thing at times when Internet Protocol was ...
      (microsoft.public.windows.server.security)
    • Re: Access denied on network share in an other domain
      ... Leaving aside the idea of the Trust for a moment, the idea is that hosts in the DMZ should have no or limited access to the LAN. ... It sounds as though what you would do is to copy out your data from the internal network to the DMZ. ... The copy needs to use credentials that the DMZ recognises, e.g a local account on the DMZ server, or else you can use a one way trust where DMZ servers trust internal server. ...
      (microsoft.public.windows.server.security)