Alex Rivera | Logout

Accessing data in internal production databases from a web server in DMZ

Asked 2010-11-09T20:19:18.963
37

I'm working on an external web site (in DMZ) that needs to get data from our internal production database.

All of the designs that I have come up with are rejected because the network department will not allow a connection of any sort (WCF, Oracle, etc.) to come inside from the DMZ.

The suggestions that have come from the networking side generally fall under two categories -

1) Export the required data to a server in the DMZ and export modified/inserted records eventually somehow, or

2) Poll from inside, continually asking a service in the DMZ whether it has any requests that need serviced.

I'm averse to suggestion 1 because I don't like the idea of a database sitting in the DMZ. Option 2 seems like a ridiculous amount of extra complication for the nature of what's being done.

Are these the only legitimate solutions? Is there an obvious solution I'm missing? Is the "No connections in from DMZ" decree practical?

Edit: One line I'm constantly hearing is that "no large company allows a web site to connect inside to get live production data. That's why they send confirmation emails". Is that really how it works?

security dmz
Edit
Report

1 Answer

4

I'm mostly with Ken Ray on this; however, there appears to be some missing information. Let's see if I get this right:

  1. You have a web application.
  2. Part of that web application needs to display data from a different production server (not the one that normally backs your site).
  3. The data you want/need is handled by a completely different application internally.
  4. This data is critical to the normal flow of your business and only a limited set needs to be available to the outside world.

If I'm on track, then I would have to say that I agree with your IT department and I wouldn't let you directly access that server either.

Just take option 1. Have the production server export the data you need to a commonly accessible drop location. Have the other db server (one in the DMZ) pick up the data and import it on a regular basis. Finally, have your web app ONLY talk to the db server in the dmz.

Given how a lot of people build sites these days I would also be loath to just open a sql port from the dmz to the web server in question. Quite frankly I could be convinced to open the connection if I was assured that 1. you only used stored procs to access the data you need; 2. the account information used to access the database was encrypted and completely restricted to only running those procs; 3. those procs had zero dynamic sql and were limited to selects; 4. your code was built right.

A regular IT person would probably not be qualified to answer all of those questions. And if this database was from a third party, I would bet you might loose support if you were to start accessing it from outside it's normal application.

answered 2010-11-23T17:14:14.083

Your Answer