Re^3: LAMP svrs - 1 or 2 is best ?

Assume you have a hardware firewall. This means that to cross the FW threshold, you have to be authorized in some fashion or another. The webserver is, generally, put into the DMZ outside this firewall. You're still going to lock down the ports, chroot the webserver and do all that stuff. But, it has to be outside the firewall so that the outside world knows how to get to it.

The DB server is inside the FW. It doesn't have an outside-accessible name. The webserver, because it's physically connected to the FW, has access to the internal DNS, so it knows how to find the DB server.

Basically, it's an additional layer protecting the only thing that's important - the data. You can't just hack the DB server - you have to hack the webserver to hack the DB, and even then, you only have the access the web application has.

In general, if you think something isn't in Perl, try it out, because it usually is. :-)
"What is the sound of Perl? Is it not the sound of a wall that people have stopped banging their heads against?"

Comment on Re^3: LAMP svrs - 1 or 2 is best ?

Replies are listed 'Best First'.
Re^4: LAMP svrs - 1 or 2 is best ? by eXile (Priest) on May 11, 2005 at 02:58 UTC
While I agree that having db and webserver on a different machine can provide an additional layer of protection (for instance against an attack where the root-account on your webserver is compromised), I want to warn against a 'put a firewall inbetween and your safe'-view. I think this is too simplistic. Firewalls are often seen as a magic box that makes your network safe. To increase your network security stuff like good intrusion detection (both on network and on a local machine), good backup/recovery procedures and common sense are as important, if not more important. There are tons of exploits in web/database apps, and commonerrors programmers make (not using placeholders while using DBI for instance) that use the webserver-to-database channel to get to the database, no firewall will help you here, as you state yourself. I highly recommend reading Bruce Schneiers 'Secrets and Lies' for a good holistic view of security. Especially the part on attack trees (building a tree of the most likely way a hacker will attack you) is very interesting. mmm, we're deviating a lot from the OP question, I'll stop muttering.	[reply]
Re^5: LAMP svrs - 1 or 2 is best ? by dragonchild (Archbishop) on May 11, 2005 at 12:43 UTC
I will wholeheartedly agree that a firewall isn't a magic box that will make you secure. It's a necessary, but not sufficient, requirement for being secure. And, it needs to be done with everything else in mind. My entire point is that you separate your servers for security-based reasons, not performance ones. The performance reasons are usually non-existent. In general, if you think something isn't in Perl, try it out, because it usually is. :-) "What is the sound of Perl? Is it not the sound of a wall that people have stopped banging their heads against?"	[reply]