|
We are running Windows Server 2008 R2 in a virtual, public facing environment. The server was provisioned with one IP address, which I, the developer, have used as the default IP address for an IIS website. Is this best practice? Should the server's IP and the website's IP be different? It is my intent to use only one IP address in IIS and user host headers to route incoming traffic. |
|||
|
|
|
It depends on what ports are open and what's firewalled off and not. I'm sure there are plenty of machines setup just like this around but you asked about best practice and certainly I think most sysadmins would be much happier to see either two IPs on the NIC, one for external traffic and one for internal management traffic - or two different physical or virtual NICs. This doesn't eradicate any security risk inherent in using a single IP but it does help to lower the risk and that would be my recommendation to you. |
|||
|
|
|
It is very common for a webserver to only have 1 IP address. IPv4 addresses are getting scarce, and people don't want to use more than they need. From a security point of view, it makes it slightly easier for an attacker to find other services on that machine, but it makes little difference. A seperate network card on a different network for management can be a security measure, but just a second IP address on the same network and interface isn't. In any case, you want to make sure you have properly configured your firewall, as well as secured services like remote desktop - if remote desktop is opened to the internet at large, it will get hammered with attacks, and some may eventually succeed. One reason you might want to have multiple IP addresses is if you are running multiple HTTPS sites, since it is much easier to setup and better supported if they are using separate IP addresses, not name based hosting. |
|||||
|
