Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a rather large internal MS SQL Database. I need to provide an interface on our website to some of our buyers. What are some good options for providing data to the website through our firewall?

Currently, all access to the internal network from the outside is done via Cisco VPN.

While we do want to provide access to authenticated users to subsets of the overall data (through the filter of an ASP.NET website), it would be very bad if all of our data leaked.

Security is a significant concern.

  • Web server is off site
  • Database server is on site

Any ideas?

Thanks.

share|improve this question

2 Answers 2

up vote 3 down vote accepted

There are probably a number of ways to do this, some more secure than others. What about setting up a DB on the web server that you can push only the relevant data to on a regular schedule via a VPN connection from your DB server to the web server.

share|improve this answer
    
I like this idea. I wonder how hard it would be to keep the VPN active at all times (or perhaps activate the VPN as needed). I'm a coder with basic knowledge of Server IT... sorry for my ignorance :) –  George W Bush Nov 30 '09 at 18:04
    
It would depend on what VPN technology is available to you. It could be done server to server, router to router, firewall to firewall, etc. How much is within your control? Do you have access to and do you control both servers? The routers? The firewalls? –  joeqwerty Nov 30 '09 at 18:45
    
I control the servers, not the internal firewall. I'll probably only have access to opening and shutting ports on the remote firewall (not access to the router's firmware). –  George W Bush Dec 1 '09 at 17:22

I currently do this a couple of different ways:

  1. I create limited user accounts on the local database that only have read access to the appropriate tables or views. Then I use stunnel to create an encrypted channel between the off-site server and the local server. The off-site server pulls from the local database as though it were local. Both machines are firewalled appropriately.
  2. I'll create a dummy database on the off-site server and push the appropriate data up on a schedule, again using stunnel for the link. Sometimes I'll create the dummy database on a local server and have the remote server talk to it as in the first method above.

Neither of these options give me a warm fuzzy feeling, but they do work. Using stunnel is nice because it's free and relatively easy to setup between Windows and Linux servers. The thing to keep in mind here is: "what happens if the remote server is compromised?"

I am converting some of these processes over to web services. You might check out something like XAware for creating these services. This has a few benefits. 1) You're not exposing your databases directly. 2) You can expose the web services directly to customers using standard web security mechanisms, and with more control than raw database access.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.