Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have three remote dedicated web servers at different webhosts. Adding them to a common domain would make a lot of administration tasks much easier. Since two of the servers are running Windows 2008 R2 Standard, I thought about promoting them to Domain Controllers in order to set up the windows domain. There's another thread at Serverfault that recommends this.

At the same time I've read a lot of times on different websites that this is not a good idea because an domain controller should always be behind a firewall LAN. But I can't set up something like this because I don't have a LAN with a static IP accessible from the internet. In fact I don't even have a windows server in my LAN.

What I have not found out is why exposing a DC to the Internet would be bad idea.

The only risk I can see is that if someone penetrates one of my webservers, it should be much easier to penetrate the others as well. But as far as I can see that's the worst case scenario since I am only going my web servers to that domain, not any computers from my local network.

Is this the only downside or does it also make it easier to penetrate one of my web servers in the first place?

Edit: What if I added a firewall rule to the DC so that incoming connections to the AD Server are only accepted if originating from the other two webservers? I mean a setup similar to the one described at http://support.microsoft.com/kb/555381/en-us but with additional ip-based rules to ensure that the DC is only reachable for the other webservers in my domain on the relevant ports.

share|improve this question
add comment

2 Answers

Doc has already covered the key point of keeping your attack surface area to a minimum, so I won't repeat that. In regard to why you shouldn't expose a DC to the Internet, the DC contains all manner of information that should not be made available to the public. By design a DC can be queried by anyone. Even without directly compromising the DC itself, just having a list of valid user accounts gives an attacker a great head start, making the answer to the last part of your question a definite yes.

share|improve this answer
    
Wall it off w/ an IPSEC policy that mandates authentication and encryption and you make it a lot harder for non-domain members to talk to the box. –  Evan Anderson Jun 23 '11 at 3:38
    
Thanks for your reply! Would my idea above (see the edit) alleviate these two concerns? –  Adrian Grigore Jun 23 '11 at 9:34
add comment

The more things you open to the net, the greater your chances of something/someone nasty getting in to your network and doing undesired things. I personally like the policy of not opening up any more than I must. If you want other networks to see your DC, I'd take a look at remotely bridging your networks through some kind of VPN rig. I believe if you have a nice router you can set that up. I've never tried, but I'd start by taking a look at pfsense.

share|improve this answer
    
+1 - A VPN is going to complicate matters, though, for things like machine Group Policy. A mandatory IPSEC policy would be a lot slicker. You can greatly minimize your attack surface by requiring IPSEC when communicating to/from the domain controller. It'll take some work to get the clients joined to the domain, initially, but once they're joined IPSEC in a domain is fairly "fire and forget". –  Evan Anderson Jun 23 '11 at 3:36
    
@Evan Anderson: What about setting up the Windows firewall as described in my post Edit above? Wouldn't that achieve more or less the same effect as setting up IPSec? –  Adrian Grigore Jun 23 '11 at 12:38
    
@Evan I'm a little confused by your comment ... how would you join the remote servers to the domain without a VPN? –  Daniel Ball Jun 23 '11 at 12:46
    
@Daniel: This is not an issue in my scenario (see my OP above). I only have 2 domain clients and I don't expect having to join more than that anytime soon. –  Adrian Grigore Jun 23 '11 at 13:03
    
@Daniel Ball: Initially you're either going to have to disable the mandatory IPSEC policy or use a mechanism that doesn't require IPSEC to perform the domain join (like, say, connecting to a VPN "behind" the DCs from which IPSEC policy allows unsecured communication). It will take some coordination to get clients joined to the domain initially. With W2K8 and Vista (or newer) you can get some of this functionality "for free". Have a look at technet.microsoft.com/en-us/library/bb726965.aspx and search for the phrase "Client-to-DC". –  Evan Anderson Jun 23 '11 at 13:14
show 5 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.