RE: NTLM authentication from DMZ

["Ben Nagy" <ben () iagu net>]

> -----Original Message-----
> From: firewall-wizards-admin () honor icsalabs com 
> [mailto:firewall-wizards-admin () honor icsalabs com] On Behalf 
> Of Volker Tanger
> Sent: Tuesday, September 17, 2002 1:37 PM
> To: miha () nil si; firewall-wizards () honor icsalabs com
> Subject: Re: [fw-wiz] NTLM authentication from DMZ
>
>
> Greetings!
>
> miha () nil si wrote:
> > I am trying to set up a WebSweeper proxy in the DMZ, and 
> enable NTLM 
> > authentication on it. Since it is not server in the domain, 
> I guess it 
> > needs to communicate with a DC, so it can Authenticate the users as 
> > they request pages form the proxy.
>
> You need to make the WebSweeper a member of the WinNT-Domain 
> in the LAN. 
> For this you need NBT (nbname / nbsession) plus probably 
> MS-RPCs for SAM 
> sync (not sure on the latter) in both directions. As DMS 
> probably is a 
> separate (non-broadcast) network you'll need a WINS server in the LAN.

You probably wouldn't want to do it that way. If you must have NTLM auth
from this box then you would set it up in a different domain with a
one-way trust relationship. When I passed my exam I used to know which
way those durn things went, but I think that the DMZ domain wants to
trust the LAN domain but not vice-versa. Now you just do your
permissions by allowing LANDOMAIN\Username. AFAIK you can get away
without MS-RPC (135 tcp) but you will need 137 and 138 udp (NBT) but not
139, I suspect. You don't need to do name resolution or browsing at all,
so don't worry about the WINS server. I'd probably just put the IP
address of the LAN DC in an LMHOSTS file and avoid the whole
browsing/broadcast mess altogether.

> Basically having NTLM auth from DMZ is not such a good idea. Better 
> place an MS-Proxy/ISA in your LAN for authentication and 
> cascade this to 
> the (then unauthenticated) WebSweeper in the DMZ. This way 
> you can leave 
> the DMZ machine (more or less) completely separated.

I completely agree with this paragraph, though. It's not a good idea,
and you would be better off not passing auth traffic back and forth from
your DMZ. The security implications are icky.

> Bye
>
> Volker Tanger
> IT-Security Consulting

Cheers,

--
Ben Nagy
Network Security Specialist
Mb: +41792504687  PGP Key ID: 0x1A86E304 

_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards