Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a team of developers who are writing both an intranet and external website.

The website consists of two servers and a load balancer, inside a DMZ.

The DMZ has a pinhole open to the LAN (http/80), to expose API services from the LAN.

e.g. WAN -> haproxy -> web01 (+web02) -> pinhole -> LAN Services (haproxy -> lan01/lan02)

The problem is that the developers have put all of their services on the LAN - including those that only run the website. i.e. web01/02 at this point is just acting as an aggrigator.

To make matters worse, the LAN services have been tied into our AD infastructure - and internal API's exposed to the DMZ - as both internal/external API's are running on port 80.

The developers do not want to split their API's to have an "internal" and "external" view, and these API's currently have no authentication/authorisation.

some services also only run on 'lan01' and not 'lan02' due to using local file storage - i.e. no high availability.

There is now a dependancy on the entire internal corp infaststructure (DNS,AD) to allow the external website to function.

There is no notion of secure practices, i.e. certain LAN API's are running as "SYSTEM" level privs, and no control over what systems the developers speak to (as they have domain admin credentials)

I have suggested moving most of the website-serving services back into the DMZ and locking these services down, but have been told that the developers cannot make the distinction between what is a "LAN" application and what is an internet application.

Anyone got any suggestions on how to deal with this? It looks like a security nightmare waiting to happen.

share|improve this question

Get some new developers as their work seems to be terrible top to bottom.

They seem to be ignoring even the most basic of the OWASP recommendations. You don't mention the size of the company nor your role but the developers work would not survive a security review.


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.