-1

I am currently hosting multiple production projects in Microsoft Azure. Each project is configured with a separate virtual network with two Windows VMs to act as web servers, and one server to act as domain controller. Security is essential in all environment so I have kept them totally isolated from one another.

I am going to create one additional virtual network which will serve as a management area, and I will connect this network to each other one with a site-to-site VPN tunnel. My goal is to use this management network as a base for centralized WSUS management, endpoint security management, GPO configuration, etc.

Would it be smart/secure to design it like this? I was thinking of having one Active Directory forest with the TLD in the management network, and each project network as a subdomain in the same forest.

Any suggestions and advice would be greatly appreciated as I attempt to plan out the best configuration. Keep in mind, it's not a problem for me to reconfigure the current project networks to fit into this new model.

7
  • Why do you need AD for these web servers? Why do you need a Domain Controller? Why do you need WSUS or GPO in this scenario? Why do you need to centrally manage these machines from a VM when you can just centrally manage them from your Azure subscription? I'm not seeing the logic, value or necessity for this setup.
    – joeqwerty
    May 24, 2016 at 20:48
  • How can I centrally manage credentials, updates, or GPO-type settings from the Azure subscription? I am open to criticism if you can offer a better solution. I would like central management to make sure I can roll out approved updates, test them in a staging environment before pushing them to production, make sure the endpoint security is fully updated. I'd also like the GPO to make it easier to harden and secure the OS. Is there a better way to do these things?
    – blizz
    May 24, 2016 at 21:10
  • Perhaps you can give us some more details? Are these web servers for different clients of yours? If so, why would you want centralized credentials? You can run the SCW on each server, so there's really no need to use GPO's to harden the servers. I'm not being critical, just trying to understand the scenario.
    – joeqwerty
    May 24, 2016 at 21:13
  • Yes the web servers are grouped into different virtual networks, and each network is for a different client. So far it's been a pain having to configure centralized monitoring, log auditing, etc. because I have to configure a new monitoring environment for each network which increases effort, complexity, and of course license cost of any management software. I figured a centralized environment would overcome this and I could go the extra mile and implement centralized credential, update, and security management.
    – blizz
    May 24, 2016 at 21:23
  • You'd be trading increased ease of management for decreased security. If one web server were compromised then every web server would be at risk. I do consulting work for one of the Big 4 consulting firms and they manage a multitude of Fortune 500/100 clients in Azure. Never is any one set of client assets allowed to access another set of client assets in any way. It makes managing them a little more work, but it ensures that we don't inadvertently create attack vectors that can "domino" across client assets.
    – joeqwerty
    May 24, 2016 at 21:28

1 Answer 1

1

The way my Big 4 client does it is by creating rules in each client NSG that lets them talk to a specific management server (or servers) for monitoring, alerting, antivirus, updates, etc. Each NSG only allows communication for specific ip addresses for the specific ports required for each VM to talk to the "management" server. So there's no centralized network, credentials, AD or anything else. No client can communicate with any other client, only to the management server and there's no "management" network that connects any client to any other client.

As for your comment about creating a separate VPN connection/network to/for each client, I think that would work as well, as long as they're all independent and isolated VPN connections/networks.

7
  • Ok so basically I think that was the same idea I originally had, minus the whole Active Directory. Which leads me to my next question: how do they manage credentials? Do they have separate local user accounts for each person/role, on each computer? Sounds like a nightmare to manage credentials and access in this way. Plus you're leaving out the ability to set centralized security policies for system access, password complexity, account lockouts, etc.
    – blizz
    May 24, 2016 at 22:08
  • BTW I am not able to open up your site, crabbygeezer.com. DNS error.
    – blizz
    May 24, 2016 at 22:10
  • Each client VM only has 3 local user accounts. They use local GPO to configure things such as password complexity, etc. and use the SCW to harden each VM. It does increase the management overhead but that's what they have to do to ensure that they're meeting their clients security mandates, legal requirements, etc.
    – joeqwerty
    May 24, 2016 at 22:12
  • Hmmm... weird about my site. I can get to it. I'll have to check my DNS hoster. Thanks for the heads up.
    – joeqwerty
    May 24, 2016 at 22:12
  • Thanks for your advice. I'm still not sure if I'll go for AD-less configuration. According to this post, the general consensus is that AD is better than not for production environments: serverfault.com/questions/53779/… Also, I'm able to get to your site now. :)
    – blizz
    May 24, 2016 at 23:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .