Subject: RE: Build SSL on Access Remote Database

From: David Marshall <[email-masked]>
Date: Thu, 28 Mar 2002 05:23:03 -0800

> Obviously it should be said that no matter what this set up would be more 
> dangerous than having a MySQL server behind the firewall where the
apache/php 
> server is hosted, also would be terribly slow.

Depending on your firewall, performance does not have to be slow. Firewalls
must be sized for the load, just like servers. 

We run a CISCO ArrowPoint Load Balancing CSS in front of Apache 1.3.19
Mod_SSL(StrongHold 3 build 3014)
We run a CISCO PIX 520 between Apache and WebLogic 5.1.
We run a CISCO PIX 535 between Weblogic and Oracle 8i without performance
issues.
The Oracle datafiles are on a Net Appliance Filer, with a 1GB ethernet from
Oracle to the Filer.

David

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Nick Miles <[email-masked]>
Date: Thu, 28 Mar 2002 14:21:45 +0000

Sorry seem to be confusing people here.  I was trying to say it would be faster 
behind the firewall than the way he is approaching it at present.

Currently he has:

            MYSQL
              |
       ---------------
USER -|   INTERNET    |- WEBSERVER
       ---------------

Where he wants to securley connect to MySQL from the webserver.  Im saying 
performance and security would be better as:

       ------------   -------------               ---------
USER -|  INTERNET  |-|  FIREWALL   |- WEBSERVER -|   DMZ   |- MYSQL
       ------------   -------------               ---------

Or combinations there of.   Hope that makes sense :/

Nick

---

From: Bruno Georges <[email-masked]>
Date: Thu, 28 Mar 2002 14:37:42 +0000

Nick,
I don't want to be pedantic but, just a quick comment,
Having MYSQL behind the DMZ won't prevent people from breaking into it.
If someone can pass through your firewall it'll be quite easy for that 
person to get Mysql username and password from your php code and access 
the data you try to protect using a DMZ.
As a result I would keep MYSQL where you have the WEBSERVER, it'll be 
faster and as secure.
Saying that, I assume that the MYSQL db server is not accessed behind 
the DMZ, if this is the case , yes you'd better keep it protected.

Hope that makes sense.

Bruno Georges

---

From: "R. DuFresne" <[email-masked]>
Date: Thu, 28 Mar 2002 11:59:39 -0500 (EST)

You bastion host the webserver, then bastion host the mysql box, and
put it either on a seperate DMZ, or at least a seperate host, and only
allow it to talk to the mysql db, and you bastion host the firewall, and
only allow http requests to the webserver in the DMZ.  Tis the standard
way to deal with these beasts.  It helps too if you have a screening
router dropping most everything through the firewall to the webserver
also.  It costs a tad more to add all the sec stuffs, but, then intel
boxen are pretty cheap.  And one can NAT the backend...

Thanks,

Ron DuFresne

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        admin & senior security consultant:  sysinfo.com
                        http://sysinfo.com

"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation."
                -- Johnny Hart

testing, only testing, and damn good at it too!