2

I'm working with a web app that uses two machines, a BSD server and a Windows 2000 server. When someone goes to our website, they are connected to the BSD server which, using Apache's proxy module, relays the requests & responses between them and the web server on the Windows server. The idea (designed and deployed about 9 years ago) was that it was more secure to have the BSD server as what outside people connected to than the Windows server running the web app. The BSD server is a bare bones install with all unnecessary services & applications removed.

These servers are about to be replaced and the big question is, is a cut-down, barebones server necessary for security in this setup. From my research online I don’t see anyone else running a setup like this (I don't see anyone questioning it at least.) If they have a server between the user and the web app server(s), it is caching, compressing, and/or load balancing. Is there anything I’m overlooking by letting people connect directly from the internet ** to a Windows 2008 R2 server that’s running the web application?

** there’s a good hardware firewall between the internet with only minimal ports open

Thank you.

Improve this question

3 Answers 3

Reset to default
4

If you take mfinni's advive and put your server in a DMZ (you surely should, and with you having a decent hardware firewall, I doubt it will prove hard), the answer is still "maybe".

I agree that there's less security reason to do this these days, IIS is far better than it was. Still, it'll throw a spanner in the works of some attacks, and you will undoubtedly gain some small security benefit.

OTOH, weigh up that you now have 3 items in the critical path, not 2 (Firewall, RProxy and webserver) - if any one goes pop, you lose service.

You need to weigh up a small security gain, vs. a management and reliability risk. If you had >1 web server, or were doing acelleration on the proxy, i'd be more inclined to keep it. As it stands, it sounds like the guy in charge (thats you) isn't hugely keen, and perhaps is a more a windows guy (i'm guessing here, don't take this as a flame or anything) and would rather not have to admin a.n.other different server. Would spending more time looking after the web server be a better investment than tinkering with the proxy?

Anyway. Gotta be your call - but I don't think it offers you quite enough to be classed as essential any more.

Improve this answer
1
  • I'm one of the programmers working on the aforementioned web app in a small (nearly all Microsoft) shop. Since the proxy server is "non-windows" and I'm more of a linux guy, I was tasked with figuring out this mostly undocumented setup and seeing what the next step was to be when upgrade time came. "small security gain, vs. a management and reliability risk" was what I was thinking as well but I wanted some additional opinions. I have my answer now though. Thanks to all those who read & commented.
    – Curtis
    Mar 22, 2010 at 14:23
0

Meh. My company's security and management standards do require an Apache reverse-proxy in front of any web server, whether it's IIS or WebSphere or what-have-you.

Although for your situation, you also don't say that the Windows server is in a DMZ. If it isn't, then do that immediately, regardless of whether or not you retain your proxy server.

Improve this answer
-1

Simple answer : No

Longer answer : No - the days of needing to hide IIS behind a *nix proxy are now firmly in the dark ages, assuming your web app is relatively secure and you firewall the windows machine well then there is no benefit in putting a proxy in front of the Windows machine from a security standpoint. The only benefit would be from a performance/load balancing point of view and it doesn't sound like that applies here.

Improve this answer
3
  • Sloppy thinking. It's always a good practice to put a proxy in front of an out-facing webserver. Why make it more vulnerable than you have to? *nix is a good choice for this because it's cheap, stable, and runs well on minimal hardware.
    – Satanicpuppy
    Mar 19, 2010 at 21:19
  • And you end up with two distinct items to update/patch and test - the questionable security benefit is in my mind outweighed by the additional administrative overhead. not to mention you have doubled your attack surface.
    – Geraint Jones
    Mar 19, 2010 at 21:27
  • with ISS history repeats itself, if you look at the bsd people attitude to security, it's solid. Microsoft put security second. They have proven time and time again that they don't understand security issues, why would this change is the future? If your connecting any kind of microsoft product to the internet without extensive hardening and intrusion detection tools, your just asking to be rooted. Can you really wait for 'patch tuesday' when you know there is a zero day exploit out there?
    – The Unix Janitor
    Mar 19, 2010 at 23:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .