Windows Forum

Ask something
Discussion Locked

IIS to SQL security

0 helpful
5 replies

by ratherbfishing

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We have an IIS application that connects to SQL 7.0 /NT4 for data. SSL will be used between browser and IIS, but I am looking for ideas on securing the data between IIS and the SQL server. The most likely scenario is that the IIS server will be outside a firewall and the SQL server inside on the internal network. I am thinking of opening a hole for PPTP through the firewall between the two servers, but am looking for any ideas. Most likely we will be using IIS5, but connecting to SQL Server on NT4.

I am looking for pointers to good usefull information, and if anyone is doing this, specific examples and/or scenarios.

Thanks!

5 replies

by quahsays

since your SQL is already inside F/W, I would think you simply open port 1433 to access SQL Server, and use application account to access database.
the next alternative depends on the application using COM/DCOM or EJB, then communication is only between SQL and the App Server which is probably even better.

by ratherbfishing

Thanks. The second answer was a bit more detailed so will get the points. I was hoping to get a comment onthe use of PPTP to protect data between IIS and the firewall.

-BH

by estebandelatorre

If your users need the sql too, the most outstanding solution is to set a firewall between them and open port 1433 from web ip address to sql ip address. (You can change this number if you want..)
Also has to disable access to xp_command shell which allows you to run a command and start a dos session.
Never use the sa account, set another user for database access.
Use a strong password for sa sql, integrated security is a plus.
Install, and here is the gol for any exposed machine, the mimimun protocol stack.
Do not share any drive in the sql server
Sp6 recommended for the server.
Be carefull of snmp services installed. They can became very vulnerable.

If budget don't allow a firewall, consider 2 nic cards for the web server and set the web server into another lan. This will prevent accesing to the sqlk server directly from internet, but trought the web server only if routing between the two cards is requiered.

Good luck

This discussion is closed to new replies.