If it is a publicly accessible server, you should place it in the DMZ - this is what zoning is all about. Setting up a server with two interfaces - one in the DMZ, one in the trusted network - just circumvents the very idea of a separate DMZ, making it entirely superfluous.
With the server in the DMZ, in general you should
- decide if the data placed on it is generally safe to be copied and used within the "Trusted" network
- if so, allow for a mechanism of data transfer between the server and the trusted network
You can easily implement 2. by just using the same protocol as your clients - connect via SFTP and pull the data off. This way, you'd save yourself the headaches of a risk assessment for an additional protocol suite.
Edit: I'll try to go with the wiki-like style and incorporate your objections into this answer and comment on them:
The data now lives in the DMZ, I
would have to seek an answer for this
internally to see if it's permissible.
The current solution doesn't
physically store the data in the DMZ,
it just has a DMZ interface.
Of course it is up to whoever designs your security policy to balance the risk of data theft for data "living" in the DMZ against having a publicly-accessible service virtually hosted in your trusted network. In most cases, you would go with the earlier while minimizing the risk of data theft by keeping the data in the DMZ for a limited time only.
Another option would be implementing a proxy solution for SFTP in your DMZ and forwarding the connections to your "trusted" server - but this would have a yet different attack surface, so it again ends up at balancing risks.
how is that more secure than simply hosting the SFTP in the trusted and allowing for direct connections?
A proxy is typically set up to have a "well-behaving" protocol exchange. This mitigates a whole class of attack vectors based on exploiting weaknesses in the protocol implementation at the server side (e.g. buffer overflows). Some proxy setups may allow you to specify restrictions on what a user can or cannot do - a capability used to reduce the attack surface by only allowing necessary operations.
But a proxy is just a piece of code prone to bugs just as is every other piece of code - it will have own attack vectors. The threat modeling and risk assessment for a "water gate" setup with two servers and polling is easier to assess.
I need the process to be automated, so I would have to use a file watching
service of sorts to watch for incoming
files in the DMZ, then forwarding to
yet another SFTP server in the
Yes, this would be a reasonable thing to do.
Now I really have to administer 2 SFTP servers on each side of the
Correct, but each of them can be a security boundary in itself - this is probably what is going to be a requirement if you are very concerned about the security of data stored there anyway.