Dual Nic Cards - Apache

[Bob McClure Jr]

On Mon, Feb 20, 2006 at 04:44:08PM -0800, Bret Stern wrote:
> 
> -----Original Message-----
> From: Bob McClure Jr [mailto:bob at bobcatos.com]
> Sent: Monday, February 20, 2006 1:36 PM
> To: bret_stern at machinemanagement.com; Getting started with Red Hat Linux
> Subject: Re: Dual Nic Cards - Apache
> 
> On Mon, Feb 20, 2006 at 01:19:12PM -0800, Bret Stern wrote:
> >
> > I'm trying to setup a web server which is exists in a DMZ.
> >
> > The server has two NIC cards.
> > One card (192.168.5.85) allows public web access; the other card
> > (192.168.0.85) allows my internal network route for html, perl 
> > updates.
> >
> > The idea is to allow public access via the 192.168.5.85 card, while 
> > letting me do html and perl updates from my internal network via the
> > 192.168.0.85 address.
> >
> > The cgi scripts which are called in the dmz would access data through 
> > the internal network 192.168.0.85 for internal databases etc.
> >
> > Is this a statisfactory and reasonably safe aproach?
> 
> I don't think so, though I'm not sure how your DMZ is connected to the 'Net
> or how your LAN is connected to the 'Net.  In general, you should not be
> able to get to your LAN from the DMZ.  Otherwise it's not much of a DMZ.
> But getting from the LAN to the DMZ is okay.
> 
> On my system, my firewall (an old AMD K6-III 450 box) has three NICs.
> One goes to the DSL modem on my assigned static IP, and the other two go to
> my DMZ (one box which is my mail and web server and has one NIC) and my LAN.
> The firewall is configured so that any machine on the LAN can get to the
> outside and to the DMZ, but nothing gets in (that is
> unrequested) except SSH and it stops at the firewall.  The firewall also
> routes ports HTTP(S), SMTP, POP3, IMAP, and a few special cats and dogs to
> the DMZ.  But the DMZ has no access to the LAN.
> 
> > Comments
> >
> > Bret Stern
> 
> Cheers,
> --
> Bob McClure, Jr.
> 
> 
> So if you had a web server, which required access to a database, couldn't
> the database be accessed via the second nic card.
> 
> [Internet]->[firewall]->routed to [web server] 192.168.5.85
>                                   [second nic] 192.168.0.85 --\
>                                                               |
>                                                               |
> 							[Local Lan switch
> |||||]
>                                                               |
>                                   [data server] 192.168.0.85 -/
> 
> >   should be                     [data server] 192.168.0.xxx

Yes, you could, but, again, you are bypassing the firewall.  So if a
cracker breaks into your web server, he has access to your LAN.

> This configuration is too risky??

I wouldn't bet my business on it.  Is it not practical to move the
database to the web server, or at least to another machine on the DMZ?

If the web server needs only read-only access to the database, you
could periodically refresh the DMZ database from the LAN database by
pushing the data out from inside.

> Thanks
> Bret

Cheers,
-- 
Bob McClure, Jr.             Bobcat Open Systems, Inc.
bob at bobcatos.com             http://www.bobcatos.com
The best things in life aren't things.