Re: DMZ Services, Best Balance Between Security and Functionality, Comments?
From: MS (ms_at_ms.net)
Date: 07/03/03
- Next message: Les: "RE: changing permissions on Downloaded Program Files directory"
- Previous message: Keith W. McCammon: "Re: DMZ Services, Best Balance Between Security and Functionality, Comments?"
- In reply to: Ben Robinson: "DMZ Services, Best Balance Between Security and Functionality, Comments?"
- Next in thread: Jeff Cochran: "Re: DMZ Services, Best Balance Between Security and Functionality, Comments?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Thu, 03 Jul 2003 08:45:10 -0400
It depends where your DMZ is --- between what and what?
If it's between your intranet and the Internet, don't extend your
internal AD forest to the DMZ.
If it's between your intranet and another company, 2 or 3 may be acceptable.
Ben Robinson wrote:
> Hi
>
> We have serveral services in the DMZ that would benefit from domain
> membership (centralised management etc), there is an additional requirement
> for external users to authenticate to a central repository (AD). Of the 5
> options described below, what would people consider to be the pro's and
> con's?
>
> 1 Workgroup everything: Poor centralised management and high TCO,
> although more secure. Not really an option due to high TCO.
> 2 Member servers in the DMZ - members of internal only AD with all
> traffic secured through firewall (IPSec etc)
> 3 Member servers in the DMZ - members of internal AD with DC(s) placed in
> DMZ, replication traffic secured with IPSec etc
> 4 Member servers in the DMZ - members of external AD forest that trusts
> internal forest (one-way only). All external users accounts in external
> forest. Trust traffic secured with IPSec
> 5 Member servers in the DMZ - members of external AD forest that trusts
> internal forest (one-way only). All external users accounts and groups in
> INTERNAL forest for centralisation, external permissions applied to
> internally located Universals. All traffic secured with IPSec and external
> forest exist purely to allow centralised management of DMZ machines.
>
> While we're interested in the risks not only to the internal network, but
> also the interception of any traffic into\out of the DMZ, and also the
> potential for seizing control of DMZ located services that could help
> leverage control of AD - internal forest would in no way trust external -
> simplicity is a key driver.
>
> Many thanks
>
> Ben
>
>
- Next message: Les: "RE: changing permissions on Downloaded Program Files directory"
- Previous message: Keith W. McCammon: "Re: DMZ Services, Best Balance Between Security and Functionality, Comments?"
- In reply to: Ben Robinson: "DMZ Services, Best Balance Between Security and Functionality, Comments?"
- Next in thread: Jeff Cochran: "Re: DMZ Services, Best Balance Between Security and Functionality, Comments?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
