SQL Test Server

[Peterb7]

I am looking to impliment a test web setup. Is it advisable to put the CMS SQL backend, located in the DMZ on its own hardware, or can I safely run test and live on the same server?

 

[SPV]

If it's just the back-end database, I don't see any problem putting it on the same server (as long as performance, disk space etc aren't a problem).

But it would be a different story if you intend changing the way the SQL Server service runs or there's some kind of application server involved which would be installed on the same server.

 

[SPV]

Having said that, my answer is based on the little information you give. You might want to expand on it if you want someone to give a more full/appropriate answer.

 

[Peterb7]

Thanks, the performance issues i can see, maybe put test and development on one server and create seperate db instances.

The scenario is that we have a production CMS with a SQL backend feeding content to our web servers (the cms runs on the web server and the SQL backend feeds the content from a seperate server) The web team want to have a test system for both SQL and web server. I have already recommended a seperate web server on its own hardware (no VM here.. yet). This leaves the SQL server. I am cautious about allowing the test database on production hardware. Even though they will be seperate SQL instances, by its nature a test system may be less secure than live, could an insecurity in the test db down the live database or leave it vulnerable? As you say performance issues or downing the server will take out both.

 

[SPV]

Yes it will be inherently less secure to have the test and live databases on the same server, even in different SQL instances (good idea, I hadn't thought about that). For example you would have to be a lot tighter on who gets the server roles such as sysadmin and securityadmin.

But once we start discussing specific vulnerabilities, I'm out of my depth.

If money permits, the separate SQL box is bound to be better. Especially as the live one is internet-facing (via its web server).

 

[Peterb7]

Thanks for that!