RE: Web server inside the firewall

["Shivdasani, Meenoo" <Meenoo_Shivdasani () NAI com>]

> We are running a Gauntlet 4.1 firewall. We allow FTP and HTTP originating
from the >inside. We have also created a POP3 plug from inside to a local
ISP. We don't allow >any traffic originating from the outside.
> I have been getting pressure lately to have a web server moved from the DMZ
to >behind the firewall. The reasoning is this will make it easier to access
databases >on our internal network. 
> The web server is IIS 4 on NT 4.0+SP3 with FrontPage extensions. The
firewall is in >its own subnet. What ports need to be opened to make this
work? 

> From a technical standpoint, this can be done.  From a security standpoint
it's a Bad Idea(tm)

The whole point of having the web server on the DMZ is that if the web
server's security is compromised, the internal network remains safe.

And it's all too easy to compromise a web server.

M