Put database into the DMZ? 1

[chicocouk]

Hi folks,

Bit of a design question, i guess, but pretty straightforward. PIX 515, three interfaces, inside, outside, dmz. Putting a webserver in the DMZ. Thing is the webserver has to access a database, which also has to be accessed directly. So for security purposes, should the database go in the DMZ too, or put the database on the inside, and open appropriate ports to allow database traffic from the webservers ip in the dmz ONLY to the database server.

All suggestions welcome

Thanks

 

[routerman]

I'd say, Webserver on DMZ, database server on inside, run host intrusion detection on the database server.

I'd prefer Webserver on DMZ 1, database server on DMZ 2, restrict acces to database from web server, but allow anyone on inside access to the database. That would mean another intreface card in the PIX.

 

[chicocouk]

Thanks for the thoughts. Ideally I agree the two dmzs would be great, but not an option due to cost.

So you reckon it would be better to have the DB server on the inside, and presumably only allow certain ports from the web to the DB?

I've been debating with myself whether thats more secure than putting the DB server in the DMZ, but blocking any access to it directly from the outside (don't allow it to nat out), and don't allow any traffic initiating from the DB server out either, so it's only directly accessible from the webserver, or from the inside.

Problem with this would be that if the webserver was compromised, it would probably have full access to the DB server, as there's nothing to filter traffic between the two.

In your design, at least if the webserver was hacked, presumably the hackers could only get access to the database ports (SQL 2000, as it happens), so no access to shares or anything like that, the pix would filter that traffic. But if they can do damage over the DB ports, then they *might* be able to get into the inside network ....

Any other thoughts most welcome

Cheers

 

[routerman]

Yes, your bang on there.

The way I look at this, if both the servers are in the DMZ then once the web server is compromised your DB server is very vunerable, and you may not have enough visibility to see what is going on.

Putting your DB server onto another LAN port puts another step in the way of the hacker, and as you say you can make the DMX to inside access pretty tight. But it is on the inside, so it carries a risk. However some later Cisco switches have a facility called private VLAN, and PIX 6.3 supports VLAN's as well, so possibly you could use this technology to increase security.

In fact while I think about that, if you could run a VLAN on the DMZ port then that may offer a partial solution, I'm not sure if VLAN support is available on DMZ ports?

I think if your not considering additional LAN ports then you need to look at host based intrusion detection as well.

have you looked at the Cisco security documents on this, there are quite a few at

http://www.cisco.com/go/safe

Whilst some of the ideas assume you have a bottemless pit of cash it discusses this problem in depth.

 

[chicocouk]

I just completed the SAFE (CSI) course yesterday as it happens, and was about to look around for the whitepaper downloads, so that's handy.

I guess there's no absolute solution unless money is no object (which unfortunately, it always is)

I'll definitely have a read and a further think. Would quite like a play with cisco's new host based ids offering, but i think you need cisco works to get it to play, and i don't have a spare 1ghz 1gig memory machine to devote to it at the moment.

Thanks

 

[routerman]

This URL has some info regarding VLAN configuration on 6.3

http://www.cisco.com/en/US/partner/...eference_chapter09186a00801727a9.html#1091798