Re: I have a matter with symantec enterprise firewall
From: Joseph V. Morris (jvmorris_at_erols.com)
Date: 05/12/03
- Next message: Joseph V. Morris: "Re: symantec firewall"
- Previous message: Joseph V. Morris: "Re: Norton firewall with norton"
- In reply to: Vincenzo Chianese: "I have a matter with symantec enterprise firewall"
- Next in thread: John Smth: "Re: I have a matter with symantec enterprise firewall"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Mon, 12 May 2003 09:45:14 -0400
Vincenzo,
A SQL Server exposed to the Internet at large? Symantec Enterprise
Firewall? On the same machine? I'd agree with Lars on this issue: If you
must, put the PRODUCTION SQL Server outside the enterprise firewall (i.e.,
on a different machine in the DMZ). Apply all known security patches,
install a good IDS on that box, possibly some memory-resident AV and AT
products, a registry monitor and file authentication software. There's no
particular problem with also putting a software firewall on the SQL Server
box, but it alone is not going to do you much good as you just put a hole in
the firewall big enough to drive a truck through. Assuming the server is an
NT/2K/XP machine, run with a non-admin account (certainly when connected to
the Internet) with full OS protection and strong passwording. If it's
feasible for your application, I would also restrict access to a specific
subset of remote IP addresses.
The DEVELOPMENT SQL Server should be an entirely separate installation
sitting on a different machine BEHIND the enterprise firewall. (Doing
development directly on the exposed machine is a great way to eat that great
enchilada in the sky.)
The primary problem with having SQL Server sitting on the same machine as
the enterprise level firewall and exposed to the Internet at large is that
if anyone finds a previously undefined (or uncorrected) vulnerability in SQL
Server, then you've quite likely had your entire LAN exploited. The stored
procedures available with SQL Server are dangerously powerful, which is
another good reason for having the exposed SQL Server OUTSIDE the firewall
(in the DMZ).
--
Regards,
Joseph V. Morris
jvmorris@erols.com
"Vincenzo Chianese" <digis.chianese@digis.it> wrote in message
news:at2ua.97756$iy5.3011987@twister2.libero.it...
> 1) How can I set SQL server on the same machine where the firewall is
> installed?
> 2) How can I make visible the machine where the firewall is installed on a
> microsoft net?
>
> Thanks for your answer
>
> Vincenzo Chianese
>
>
- Next message: Joseph V. Morris: "Re: symantec firewall"
- Previous message: Joseph V. Morris: "Re: Norton firewall with norton"
- In reply to: Vincenzo Chianese: "I have a matter with symantec enterprise firewall"
- Next in thread: John Smth: "Re: I have a matter with symantec enterprise firewall"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
