RE: What is more secure?

From: Tomas (s.tomas_at_gmail.com)
Date: 02/28/05

  • Next message: amandeep Singh: "Preventing Copy/ Paste" 
    To: "'Alvin Oga'" <alvin.sec@Virtual.Linux-Sec.net>
Date: Mon, 28 Feb 2005 04:04:26 +0200

    My web server is on Windows 2003 server box with IIS 6 (that’s my company's
    policy and I can't do anything about it), so it's hardened to the point
    Microsoft allows it to be :) and my firewall is OpenBSD box (I love this OS
    :) and of course it's hardened the point my knowledge allows it to be :).
    The network is so small (only a few servers, because it's a DMZ network) and
    if I assume that the hacker is in it than I will assume that the hacker is
    in the web server itself and there will be no point in protecting it... So
    now I need to figure out that is more secure, to give all public ips to the
    web server and filter traffic with bridging firewall or to give all public
    ips to firewall itself and only forward certain ports to the web server with
    internal ips. Blackhat wrote that it's more secure to give all public ips to
    firewall and to forward ports to web's internal ips (sorry blackhat if I
    understood you wrongly), but then the hacker will be making his attack on
    the firewall and if he succeed he will gain all access to both networks:
    internal and DMZ. And if I'll give all public ips to the web server and make
    bridging firewall then the hacker will be making his attack directly on the
    web server and if he succeeds he will gain access to web server only. Or am
    I wrong... I'm a little confused here...

  • Next message: amandeep Singh: "Preventing Copy/ Paste"

    Relevant Pages

    • Re: 2003 Web Server Security flaw
      ... > If a hacker can get past the firewall and into the Web Server, ... > he MAY not require someone to be using the program exe. ...
      (microsoft.public.windows.server.security)
    • Re: Local web servers - was Re: ISP Virgin
      ... The hacker doesn't care what OS you use - just that he can ... RISC OS lacks security protection which are required if you want to ... Your statement seems to confirm that the risks of running a web server ... router's firewall presents a security risk which none of us have seen in ...
      (comp.sys.acorn.misc)
    • Re: disconnect a hacker
      ... My Web server station is right next ... my attention divided by security concerns... ... see an IP connected to port 80, ... I've been forwarding my firewall logs to my ISP, ...
      (alt.computer.security)
    • Re: Firewall on server itself
      ... Perhaps the iptables could defend against an intruder who is already ... Firewall vender specific vulnerabilities ... >> be configured to protect the web server as well other computers on ... > The Gartner Group just put Neoteris in the top of its Magic Quadrant, ...
      (Security-Basics)
    • Re: [fw-wiz] Using SSL accelerators in firewalls
      ... It also depends on what you're using your SSL for, and how tightly you can couple ... your firewall with your web application. ... web server don't have to be very aware of each other. ... >> lost in the process and the security of transactions eroded. ...
      (Firewall-Wizards)