@SisterOfMercy:
@SisterOfMercy:
@Inperpetuammemoriam:
Hey guys,Therefore, the virtual machines running all the services should be the only ones making use of the DMZ sided port in order to offer their services to the outside world.
Do you mean you are only exposing non-management services on the DMZ, such as a web server, and the SSH ports are only open to the LAN?
Yes, that would (have) be(en) the idea.
@BlueKobold:
@BlueKobold:
Connect to the pfSense a DMZ and a LAN Switch
Place the entire server connected to the web in a real DMZ
Ok, so the better way would be to completely isolate the Server within the DMZ from the LAN.
@BlueKobold:
Let the DMZ servers only connect to the Internet through Squid onto the pfSense
I never used squid before but from what I read about it (squid-cache.org), the main feature is a performance gain rather than a security gain. Did I miss something?
@BlueKobold:
Connect the servers through the IPMI port or over KVM switches placed in VLAN1 (default)
I'm not using the IPMI port. It could have been useful to be able to remotely manage the server even before the OS has booted but from what I read about it I think there comes a much bigger security loss than a gain in usability with it. The risk of someone implanting low level spy/malware (which is really hard to detect) outweighs the benefits by far.
@BlueKobold:
Set up a DMZ and LAN radius server that only you will be able to secure connect to the servers
I also never used a radius server before but wouldn't this be like taking a sledgehammer to crack a nut? From what I read, I assume there comes a big configurational and computational overhead with it but little to no gain in protection from the WAN side. Wouldn't it be better to just be very restrictive in the firewall configuration concerning traffic intended for the DMZ? (e.g. allowing the SSH access only from the LAN side and restricting WAN access to the few required ports)
@BlueKobold:
Set up snort sensors and servers to gain more security inside of your network
Snort is already running. ;-) However, even with a not so conservative configuration I had to suppress a few alerts otherwise the internet experience would have been drastically reduced. Is this normal?
