Windows 2003 server in DMZ for websites -- iis security

iis security : Windows 2003 server in DMZ for websites

bits on glass
6/26/2004 11:22:47 PM

I have a Windows SBS 2003 behind a PIX firewall with several clients behind
the SBS. I want to place a Windows 2003 server in the DMZ to host a couple
of external sites. I have enough static IPs to support the site. I am
searching for a good resource to answer several questions related to
managing the server in the DMZ:

1. Should the server in the DMZ be a stand alone server with no connection
to the backend network, or should it be member server and dual NIC'd, one to
the DMZ LAN and one on the backend network behind the SBS? I believe making
it a stand-alone is the preffered design, but not sure how to control
access.

2. How do I allow a remote user access to manage their site which I would
like to build for them.

I know it might be best to have a hosted service provided by others, but I
happen to have the Windows 2003 server software, I have the server and I
have the interest to find out the correct way to run an external website in
a Windows SBS 2003 environment.

What I am seeking answers to is what is best practice for security and
protection of my internal SBS network, where an external site is required,
and where the site will host content from customers who are not users within
the SBS domain but need acces to their site for placing content, mananging
that content, etc. If I make it a stand alone in the DMZ, how do I manage it
as well for normal routing system administration tasks?

Thanks!

Miha Pihler
6/27/2004 6:28:38 PM

Hi,

having two cards in server, one lading to the internet through the firewall
and one bypassing it into the LAN really destroys the point of having
firewall in first place. If someone is able to hack your server in DMZ he
has free access to LAN so there is no point in having DMZ. Servers and
computers in DMZ should not have any direct access to LAN in any way (either
by bypassing a firewall or by rules on the firewall)...

Since there should be no communication between DMZ and LAN (in direction DMZ
to LAN) servers in DMZ should be standalone servers. If you have them in
domain, your firewall will have more holes in it then cheese.

Regarding remote administration, you could allow e.g. Terminal Service
Access only from LAN to DMZ and Administrators of the web site content could
use Front Page for administration...

I hope this helps you out at least a bit,

Mike

[quoted text, click to view]

bits on glass
6/27/2004 6:51:35 PM

Mike,

Thanks for confirming what I identified in my post where I indicated I
thought making it a stand alone would be the preffered design where security
is the focus. I just wanted to throw the question out there in the event
there was some cool way to manage security at the server level in a dual
NIC'd Windows server design allowing for easier administration.

While I do my best to stay current with the Windows server environment is a
bit new to me and I accept that there are many things I do not know so I
better ask! :-)

~ bits

[quoted text, click to view]

jeff.nospam NO[at]SPAM zina.com
6/27/2004 8:31:38 PM

On Sat, 26 Jun 2004 23:22:47 GMT, "bits on glass" <news@evanetllc.com>
[quoted text, click to view]

Stand alone unless you have a reason not to. Since you're asking the
question, you don't have a valid reason to make the system part of a
domain. :)

You would never add a second internal NIC to a server in the DMZ.
That negates the DMZ.

[quoted text, click to view]

Depends on what "manage" means in this case. Might look at using a
control panel:

IIS Control Panels:
http://www.adsi4nt.com/
http://www.nthelp.org/

[quoted text, click to view]

It's still best to put it elsewhere. :)

[quoted text, click to view]

Provide a remote control solution for your administration, such as
Terminal Services. Using a VPN is preferable. For customers to
manage content, set up FTP access for them.

Miha Pihler
6/27/2004 9:56:40 PM

It's really hard and uneasy to give security configuration advice with so
little information... There are many things to take into consideration when
planning such an environment. I try to do my best from my personal
experience and how I would advice my clients.

If you have any more questions allong the way, stop by :-)

Mike

[quoted text, click to view]

Karl Levinson [x y] mvp
6/30/2004 8:35:30 PM

In addition to the other answers here, be sure you have read the documents
at www.microsoft.com/technet/security on how to harden Win2003. One of the
documents even describes how to configure it as a "bastion host."

[quoted text, click to view]

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages about iis security

View Other Months
June 2003
July 2003
August 2003
September 2003
October 2003
November 2003
December 2003
January 2004
February 2004
March 2004
April 2004
May 2004
June 2004
July 2004
August 2004
September 2004
October 2004
November 2004
December 2004
January 2005
February 2005
March 2005
April 2005
May 2005
June 2005
July 2005
August 2005
September 2005
October 2005
November 2005
December 2005
January 2006
February 2006
March 2006
April 2006
May 2006
June 2006
July 2006
August 2006
September 2006
October 2006
November 2006
December 2006
January 2007
February 2007
March 2007
April 2007
May 2007
June 2007
July 2007
August 2007
September 2007
October 2007
November 2007
December 2007
January 2008
February 2008
March 2008
April 2008
May 2008
June 2008

home · blog · groups

Questions? Comments? Contact the dn