You bastion host the webserver, then bastion host the mysql box, and
put it either on a seperate DMZ, or at least a seperate host, and only
allow it to talk to the mysql db, and you bastion host the firewall, and
only allow http requests to the webserver in the DMZ. Tis the standard
way to deal with these beasts. It helps too if you have a screening
router dropping most everything through the firewall to the webserver
also. It costs a tad more to add all the sec stuffs, but, then intel
boxen are pretty cheap. And one can NAT the backend...
Thanks,
Ron DuFresne
On Thu, 28 Mar 2002, Bruno Georges wrote:
> Nick,
> I don't want to be pedantic but, just a quick comment,
> Having MYSQL behind the DMZ won't prevent people from breaking into it.
> If someone can pass through your firewall it'll be quite easy for that
> person to get Mysql username and password from your php code and access
> the data you try to protect using a DMZ.
> As a result I would keep MYSQL where you have the WEBSERVER, it'll be
> faster and as secure.
> Saying that, I assume that the MYSQL db server is not accessed behind
> the DMZ, if this is the case , yes you'd better keep it protected.
>
> Hope that makes sense.
>
> Bruno Georges
>
> Nick Miles wrote:
>
> >Sorry seem to be confusing people here. I was trying to say it would be faster
> >behind the firewall than the way he is approaching it at present.
> >
> >Currently he has:
> >
> > MYSQL
> > |
> > ---------------
> >USER -| INTERNET |- WEBSERVER
> > ---------------
> >
> >Where he wants to securley connect to MySQL from the webserver. Im saying
> >performance and security would be better as:
> >
> > ------------ ------------- ---------
> >USER -| INTERNET |-| FIREWALL |- WEBSERVER -| DMZ |- MYSQL
> > ------------ ------------- ---------
> >
> >
> >Or combinations there of. Hope that makes sense :/
> >
> >Nick
> >
> >
> >Quoting David Marshall <[EMAIL PROTECTED]>:
> >
> >>>Obviously it should be said that no matter what this set up would be more
> >>>
> >>>dangerous than having a MySQL server behind the firewall where the
> >>>
> >>apache/php
> >>
> >>>server is hosted, also would be terribly slow.
> >>>
> >>Depending on your firewall, performance does not have to be slow. Firewalls
> >>must be sized for the load, just like servers.
> >>
> >>We run a CISCO ArrowPoint Load Balancing CSS in front of Apache 1.3.19
> >>Mod_SSL(StrongHold 3 build 3014)
> >>We run a CISCO PIX 520 between Apache and WebLogic 5.1.
> >>We run a CISCO PIX 535 between Weblogic and Oracle 8i without performance
> >>issues.
> >>The Oracle datafiles are on a Net Appliance Filer, with a 1GB ethernet from
> >>Oracle to the Filer.
> >>
> >>David
> >>
> >
> >
> >______________________________________________________________________
> >Apache Interface to OpenSSL (mod_ssl) www.modssl.org
> >User Support Mailing List [EMAIL PROTECTED]
> >Automated List Manager [EMAIL PROTECTED]
> >
>
>
> ______________________________________________________________________
> Apache Interface to OpenSSL (mod_ssl) www.modssl.org
> User Support Mailing List [EMAIL PROTECTED]
> Automated List Manager [EMAIL PROTECTED]
>
--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
admin & senior security consultant: sysinfo.com
http://sysinfo.com
"Cutting the space budget really restores my faith in humanity. It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation."
-- Johnny Hart
testing, only testing, and damn good at it too!
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
