RE: AD in the DMZ . . . OK?

["Dieter Sarrazyn" <dsr () ascure com>]

What about your email traffic then?

The traffic I'm talking about is only a very limited ldap traffic with a
very restricted user.

Regards,
Dieter 

> -----Original Message-----
> From: Ansgar -59cobalt- Wiechers [mailto:bugtraq () planetcobalt net] 
> Sent: vrijdag 30 juli 2004 20:54
> To: security-basics () securityfocus com
> Subject: Re: AD in the DMZ . . . OK?
>
> On 2004-07-30 Dieter Sarrazyn wrote:
> > Wouldn't using LDAP be a solution here? Every AD system is in fact 
> > also an ldap server.
> >
> > If the only thing needed is authentication with 
> userid/password, then 
> > this is fairly simple to do. A special group could be created 
> > containing all users that are allowed to use this type of 
> > authentication. Using a "ldap-read" user which has only 
> read access to 
> > this group is pretty secure I guess.
>
> If I'm reading you correctly that would still require access 
> from the DMZ to the DC, thus still violating the DMZ. No host 
> in the DMZ should ever be able to access any service inside 
> the internal network.
>
> Regards
> Ansgar Wiechers
> --
> "Those who would give up liberty for a little temporary 
> safety deserve neither liberty nor safety, and will lose both."
> --Benjamin Franklin
>
> --------------------------------------------------------------
> -------------
> Ethical Hacking at the InfoSec Institute. Mention this ad and 
> get $545 off any course! All of our class sizes are 
> guaranteed to be 10 students or less to facilitate one-on-one 
> interaction with one of our expert instructors. 
> Attend a course taught by an expert instructor with years of 
> in-the-field pen testing experience in our state of the art 
> hacking lab. Master the skills of an Ethical Hacker to better 
> assess the security of your organization. 
> Visit us at: 
> http://www.infosecinstitute.com/courses/ethical_hacking_training.html
> --------------------------------------------------------------
> --------------

---------------------------------------------------------------------------
Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off
any course! All of our class sizes are guaranteed to be 10 students or less
to facilitate one-on-one interaction with one of our expert instructors.
Attend a course taught by an expert instructor with years of in-the-field
pen testing experience in our state of the art hacking lab. Master the skills
of an Ethical Hacker to better assess the security of your organization.
Visit us at:
http://www.infosecinstitute.com/courses/ethical_hacking_training.html
----------------------------------------------------------------------------