4

I have three remote dedicated web servers at different webhosts. Adding them to a common domain would make a lot of administration tasks much easier. Since two of the servers are running Windows 2008 R2 Standard, I thought about promoting them to Domain Controllers in order to set up the windows domain. There's another thread at Serverfault that recommends this.

At the same time I've read a lot of times on different websites that this is not a good idea because an domain controller should always be behind a firewall LAN. But I can't set up something like this because I don't have a LAN with a static IP accessible from the internet. In fact I don't even have a windows server in my LAN.

What I have not found out is why exposing a DC to the Internet would be bad idea.

The only risk I can see is that if someone penetrates one of my webservers, it should be much easier to penetrate the others as well. But as far as I can see that's the worst case scenario since I am only going my web servers to that domain, not any computers from my local network.

Is this the only downside or does it also make it easier to penetrate one of my web servers in the first place?

Edit: What if I added a firewall rule to the DC so that incoming connections to the AD Server are only accepted if originating from the other two webservers? I mean a setup similar to the one described at http://support.microsoft.com/kb/555381/en-us but with additional ip-based rules to ensure that the DC is only reachable for the other webservers in my domain on the relevant ports.

2 Answers 2

4

The more things you open to the net, the greater your chances of something/someone nasty getting in to your network and doing undesired things. I personally like the policy of not opening up any more than I must. If you want other networks to see your DC, I'd take a look at remotely bridging your networks through some kind of VPN rig. I believe if you have a nice router you can set that up. I've never tried, but I'd start by taking a look at pfsense.

10
  • +1 - A VPN is going to complicate matters, though, for things like machine Group Policy. A mandatory IPSEC policy would be a lot slicker. You can greatly minimize your attack surface by requiring IPSEC when communicating to/from the domain controller. It'll take some work to get the clients joined to the domain, initially, but once they're joined IPSEC in a domain is fairly "fire and forget". Jun 23, 2011 at 3:36
  • @Evan Anderson: What about setting up the Windows firewall as described in my post Edit above? Wouldn't that achieve more or less the same effect as setting up IPSec? Jun 23, 2011 at 12:38
  • @Evan I'm a little confused by your comment ... how would you join the remote servers to the domain without a VPN?
    – Daniel B.
    Jun 23, 2011 at 12:46
  • @Daniel: This is not an issue in my scenario (see my OP above). I only have 2 domain clients and I don't expect having to join more than that anytime soon. Jun 23, 2011 at 13:03
  • @Daniel Ball: Initially you're either going to have to disable the mandatory IPSEC policy or use a mechanism that doesn't require IPSEC to perform the domain join (like, say, connecting to a VPN "behind" the DCs from which IPSEC policy allows unsecured communication). It will take some coordination to get clients joined to the domain initially. With W2K8 and Vista (or newer) you can get some of this functionality "for free". Have a look at technet.microsoft.com/en-us/library/bb726965.aspx and search for the phrase "Client-to-DC". Jun 23, 2011 at 13:14
1

Doc has already covered the key point of keeping your attack surface area to a minimum, so I won't repeat that. In regard to why you shouldn't expose a DC to the Internet, the DC contains all manner of information that should not be made available to the public. By design a DC can be queried by anyone. Even without directly compromising the DC itself, just having a list of valid user accounts gives an attacker a great head start, making the answer to the last part of your question a definite yes.

2
  • Wall it off w/ an IPSEC policy that mandates authentication and encryption and you make it a lot harder for non-domain members to talk to the box. Jun 23, 2011 at 3:38
  • Thanks for your reply! Would my idea above (see the edit) alleviate these two concerns? Jun 23, 2011 at 9:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .