Re: DMZ best practices

[Amos Hayes <ahayes () polkaroo net>]

On Mon, 18 Jan 1999, Jeromie Jackson wrote:

> At 04:03 PM 1/16/99 -0800, John Kozubik wrote:
>
> > Now, what kind of machines would you put in the DMZ?  Not many, in my 
> > opinion.  Mail, news, www, etc. should _always_ be behind a firewall 
> > with a security policy in place.  
>
> Your  web server certainly should NOT be behind your firewall.  This would
> completely compromise the function of the firewall.

I think people might have misunderstood John's comment. "A firewall" is
not necessarily "Your (one and only) firewall".

I would agree that all your servers should be behind a firewall. But that
doesn't mean that they should all be behind one of your _innermost_
firewalls.

--
Amos Hayes
ahayes () polkaroo net                  Ingenia Group - Software Kinetics Ltd.
http://polkaroo.net/~ahayes                     http://www.sofkin.ca