Web DMZ Firewall to SQL access restrictions 1

[CXO]

In looking around the usergroup I found this reference to various setups of firewalls and SQL server access.

Is there a way of tightening up security if you only have one DMZ with a web server that is talking to an internal SQL server?(b)

With SQL there are a few schools of thought... there is no perfect solution...

a) Stick it in the DMZ - if you get hacked your SQL data could be compromised. Issues with viewing/updating the data internally.

b) Stick it in the LAN and create pinholes in the firewall. This allows easy internal access to the SQL server, network is under threat if server is compromised.

c) Two DMZs, one with webserver, the other with SQL server. Hacking into the SQL server is much harder as communication has to go through the firewall, hacker won't be able to penetrate into the network. Again problems with updating SQL server internally - and a little more complex to setup.

d) Two SQL servers, one in DMZ, one in LAN. The DMZ SQL server has a minimal data set,the LAN server has the full data set. Complex replication issues - securing the network and making replication is tough. Can a SQL server have a minimal data set that is safe to be comprised?

 

[mrdenny]

When working with a DMZ my preference is to place the web server in the DMZ, and pinhole the firewall to the SQL Server. For an added layer of security use NT auth only, and disable SQL Auth. For additional security you can encrypt the SQL connection via SSL (I haven't done this my self). This way, if a hacker does get onto the DMZ, they can't sniff any usefull info from the connection to the SQL Server, as it's all encryted.

Denny

--Anything is possible. All it takes is a little research. (Me)

 

[CXO]

Thanks Mr Denny

We had the web server setup to talk to a SQL server 2000 database in mixed mode. (Worked OK)
When we setup the database for windows authenication only(for added security) the web access fails with an error message that states the reason as not associated with a trusted SQL connection.

I am a novice in this area - so what is required to setup a trusted connection?
It is my guess that the trusted connection uses the anonymous aspnet ID.
The web config file was changed to use windows authentication mode
Trusted_Connection=true was added to the connection string
allow users was set to (?) anonymous
Login failed for user 'NT authority \ anonymous logon'
I also tried various userids
If I am specifing a userid - Do I have to set the ID as trusted in active directory user setup area?

Does any one have an example of a web.config file for a windows authentication only setup?

 

[mrdenny]

I'm not sure how to get ASP.NET to login via a trusted connection. Somethings to check (they work for regular old ASP pages).
1. Make sure that the account that the web service is running under is a domain account.
2. Make sure that the account you've set the web service to run as has access to the database.

Denny

--Anything is possible. All it takes is a little research. (Me)