Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are in the process of setting up a DMZ and I have stumbled into the question of how to handle machines that need to have ports exposed to the internet, but at the same time be able to make LDAP requests to our internal environment. We have a few Linux applications that only work by making LDAP requests to authenticate users. I am not sure if we can configure Kerboros or not (still checking), but I believe it must be done via straight up LDAP queries.

What would you recommend doing with a machine that required LDAP and be exposed directly to the internal at the same time?

Thanks in advance!

share|improve this question

Well, I believe that the best option is to Setup a slave LDAP server inside the DMZ. The Master/Replica LDAP will push changes to the slave LDAP over SSL (even self-signed certificates are fine) and your clients will ask over SSL the Slave LDAP.

A "schema" is the following:

(Back End)Master LDAP-->Replica LDAP-->(Firewall)-->(DMZ) Slave LDAP

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.