Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have two Linux servers connected to each other via a cross-connect cable, forming a local network. One of the servers presents a DMZ for the other server (e.g. database server) that must be very secure.

I'm restricting this question to communication between the two servers for ports that only need to be available to these servers (and no one else). Thus, communication between the two servers can be established by:

(1) opening the required port(s) on both servers, and authenticating according to the applications' rules.

(2) disabling IP Tables associated with the NIC cards the cross-connect cable is attached to (on both servers).

Which method is more secure?

In the first case, the needed ports are open to the external world, but protected by user name and password.

In the second case, none of the needed ports are open to the outside world, but since the IP Tables are disabled for the NIC cards associated with the cross-connect cables, essentially all of the ports may be considered to be "open" between the two servers (and so if the server creating the DMZ is compromized, the hacker on the DMZ server could view all ports open using the cross-connect cable).

Any conventional wisdom how to make the communication secure between two servers for ports only these servers need access to?

share|improve this question

2 Answers 2

Well I'm leaning towards one: Make sure that only connections from that can be made, originate from the server. So you need to add a source option to the iptables rules. Then you still have a defense in place with authentication. The problem is that if there's an application running on the server that can login to the database, there might be a chance that a malicious user finds it out IF he gets access to your server.

What I don't understand is why you would disable iptables on a NIC, it's not because you enable iptables on a NIC that all of a sudden it's accessible by the WAN. On the contrary, you can restrict access with it.

share|improve this answer
    
Thanks Lucas, I think you're mentioning a third method (correct me if I'm wrong): method (1) above that also restricts access to the local network servers only. Is that right? This was what I asked the hosting company to provide for me but they only knew how to do the 2 options above. Maybe I'll try to figure it out myself (let me know if there's any easy way to do this using CSF). –  gkdsp Mar 25 '12 at 0:28
    
Well, then I'd go for the second option, you can always add iptables yourself if you have access to the machines. Another option would be installing openvpn and using a vpn between your two machines. –  Lucas Kauffman Mar 25 '12 at 0:58
    
What do you think about using the method in this link, where instead of 12.345.67.89, I use the local IP address of the OTHER server (e.g. use 192.168.0.1 on server 192.168.0.2; and use 192.168.0.2 on server 192.168.0.1)? serverfault.com/questions/155094/… –  gkdsp Mar 25 '12 at 1:30

You should combine the methods and use iptables.

machineone has ip machineone machinetwo has ip machinetwo

on machineone:

-A INPUT -s machinetwo -d machineone --dport allowedport2 -j ACCEPT
-A INPUT -s machinetwo -d machineone --dport allowedport2 -j ACCEPT
-A INPUT -j DENY

on machinetwo:

-A INPUT -s machineone -d machinetwo --dport allowedport1 -j ACCEPT
-A INPUT -s machineone -d machinetwo --dport allowedport2 -j ACCEPT
-A INPUT -j DENY
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.