Re: web server dmz sql server
- From: "Joel Maslak" <jmasla@xxxxxxxxxxx>
- Date: 19 Nov 2006 20:00:08 -0700
<E78D293A-9959-4298-8F67-3633F3524CE9@xxxxxxxxxxxxx>,On Fri, Nov 17, 2006 at 11:55 AM, in message
callwalker<callwalker@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
I have a web server on the DMZ. I would like to be able to use the
SQL server
on the lan for the database. Security does not want to open a port
in the
firewall.How can i persuade them? Would it help to put the SQL
server on
vlan? What would be the best wat to do this?
It really depends on your company's policies and procedures.
That said, how I like to do it is to put SQL on a dedicated port of the
firewall (or VLAN routed through the firewall). Then you can let
traffic into the SQL server, but prevent the SQL server from being able
to contact other hosts on the inside of the network. It also lets you
limit the traffic from the web host to the SQL server to just one port,
1433 (TCP).
It's a pretty small hole in the firewall, but I would be concerned if I
were in their shoes too - someone with sufficient access to the SQL
server can find ways of executing a command shell, and from there attack
the rest of the network, even without any bugs in SQL. (it is a good
argument for the application NOT using SA or any login with DBO access
to any database)
.
- Prev by Date: Re: Version Control
- Next by Date: RE: Proprietary data in SQL2005
- Previous by thread: Re: Version Control
- Next by thread: Re: Should you use local machine groups?
- Index(es):
Relevant Pages
|
|
