Security

Ask something
Discussion Locked

Remote Access

0 helpful
3 replies

by exnn

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I have an document db, which holds .doc and .pdf files. The server is "reachable" and "searchable" from any computer on the internet, however the only way to view the documents is if the request is made by any computer from our LAN (restriction by ipaddress). Management will not change this. Users authenticate on a Win2K3 Server, all computers within domain. Now the service needs to be available for authenticated users which can connect to any computer on the internet (hotspot, office laptop, home computer, public at internet cafe, etc). That's why a "standard" VPN can not be set since no client application can be installed. Users need to authenticate in the domain. I understand RRAS and IAS can help me do this job. But not really sure how to. Any suggestions? It will be very much appreciated.

3 replies

by bdragomir

not sure that I completly understand what you want to do "available for authenticated users which can connect to any computer on the internet" if I understand well your users will be mobile and connect from any machine on the net ...in other words you want to allow external access to that server. Then on this idea you need to either move the server on to DMZ and maintain your authentication method (from inet to tacacs), then allow authenticated users access to server's resources or you can put the doc's on a backend db write a app that will query the db and serve the doc. either way keep an open eye on existent vulnerabilities and make sure that your firewall will not allow allow access other than the one intended. Lastly...keep a good documentation for future expansion of you network.

by cg it

I'm with the first guy. don't completely understand what you want to do.

When you say "the service needs to be available for authenticated users which can connect to any computer on the internet"...I don't understand why "...VPN can not be set since no client application can be installed". A virtual private network connection is like having the remote clients connecting as if they are on the LAN.

RRAS e.g. Routing and Remote Access allows a pool of LAN addresses be reserved for remote access clients and allows DHCP relay agent but then most VPN appliances also provide the same features of RRAS. Many intergrate authentication of remote clients via Windows authentication methods.

Please provide more information on the exact problem.

by secureplay

First, it is probably not a good idea for a server that is supposedly protected (you say only usable by intranet users) to be reachable from the Internet. It should be hidden behind your firewall or at least NAT'ed. Probably this means that other servers that you have should be better protected. You are probably spewing an awful lot of company info onto the internet and certainly exposing yourself to potential attacks.

Second, if you have data that you need to share at least semi-publicly, set up a separate server that you secure appropriately for controlled Internet access. Hardware is cheap & a better security system than software alone or even a firewall or router. It makes for clean, clear, understandable isolation.

The best firewall is a pair of wire cutters.

It sounds like this is an information repository rather than a dynamic resource. If so, then a simple "push" or copy from your intranet to the DMZ / public ISP location would work. If the site is interactive, then set up a polling system to push & pull data to this server from your intranet. Quarantine the data and check it out before letting it in or out based on your business needs and policy for this information.

If you have a bit of a budget & are on the paranoid side, you can use an SSL-VPN with tokens issued to authenticated users. Otherwise, a user-name/password protected web server should meet your needs.

Steven Davis
CEO
IT GlobalSecure Inc.
http://www.secureplay.com/
http://www.playnoevil.com/ blog

This discussion is closed to new replies.