SBS server with inside and outside NIC - good idea ? 1

[gmail2]

Hi All

I'm new to SBS so if any of my questions sound foolish, apologies !

I've just completed a site survey for a (potentially) new network customer. They have an SBS server there whi is escentially an "everything" server. However, I have a few questions about this:

1. The server has 2 NIC's, one connected to the LAN and one connected to the internet. I know that this is not uncommon for SBS servers, but I'm wondering in the real world if many companies actually do it this way ? It seems like a very risky game to me. Surely a proper dedicated corporate firewall with NAT would be the way to go

2. I've run a port scan against the public IP address of the server and found a whole lot of ports open (3389, 21, 25, 80, 443 etc etc). When configuring windows firewall on an SBS 2003 server, is it not possible to only open certain ports for certain NIC's ? Or when you open a port, is it then open for all NIC's (depending on the service configuration)

3. This brings me onto my next quesiton, given that all these ports are open to the internet, this obviously makes the server more vulnerable, so if an exploit was discovered in one of these services (eg IIS) I would imagine a server with direct connection to the internet would be more at risk. I've also heard that it can take longer for MS to release patches for SBS server. Taking these 2 factors into account, are SBS servers more commonly attacked than regular 2003 standard/enterprise servers ?

4. In this particular scenario, the mail relay server for the company domain is the SBS server. So if the server ever goes down, mail may be missed due to the sender's mail server not being able to communicate with the SBS server and giving up (depending on the sending mail server config). Surely a better option would be to use an ISP's mail relay server ?

However, my bigger concern is that it's possible for a malicious user to continuously connect to port 25 and create a whole lot of sessions (and overhead) for the server, and make it extremely busy, and cause slow access for the file server users on the inside. Does SBS have any "inbuilt" security mechanism to limit the number of sessions ?

Sorry for all the questions. I do appreciate any help anybody can provide

Irish Poetry - Karen O'Connor
Irish Poetry and Short Stories - Doghouse Books
Garten und Landschaftsbau

 

[colinT23]

Hi,

No, it's not a good idea. This is one of the reasons MS dropped the dual NIC approach with SBS 2008. Any server (SBS or otherwise ) connected directly to the 'net is a disaster waiting to happen. Revert the server to a single NIC - much easier administration all round. Get a corporate class firewall or better still, a UTM. I'd recommend Watchguard products. Great firewalling and capable of stripping malware and spam. The only ports you want open on your firewall are 25 (mail), 443 (if you need OWA/RWW), 3389 (only if you need RDP) and 4125 (if you need RWW). Port 80 should never be opened as this is for web sites and you shouldn't be hosting a website on an SBS box, contrary to what MS say.

Regards Colin.

 

[gmail2]

Thanks for the reply colin ... that's pretty much what I thought aswell, but as I've no SBS experience I wanted to see what others were doing.

What about the mail relay issue, would most companies with an SBS server use their ISP for the mail relaying or would they use the SBS server for this ? This also seems a little risky to me to be honest, but I'm no expert either

Irish Poetry - Karen O'Connor
Irish Poetry and Short Stories - Doghouse Books
Garten und Landschaftsbau

 

[colinT23]

Hi,

SBS was designed to be used to it's fullest capacity and that includes Exchange. The best way to use your SBS box is to allow Exchange to receive email directly from the Internet via SMTP. Do not use ISP's or POP3 connectors etc. Yes, there is a risk of malicious users out there trying to log into your server via port 25 (SMTP) to use your server as a relay. 2 things here - out of the box, SBS/Exchange is NOT an open relay. Secondly, if you implement a Watchguard Firebox in front of the SBS box, you can deny all access to countries/ISP's that you definitely don't want to communicate with. I've banned entire continents (APNIC, AFRINIC, etc) from contacting my client's servers - they don't do business with China for example so why accept mail (and possible hacking attempts) from these countries ? Reduce your surface attack area as much as possible and you won't have to worry about relay attempts.

Regards Colin.