RE: [ActiveDir] what to do with DMZ servers

[Roger Seielstad]

Title: Message

"nuances"?? More like 4 inch square fence posts.     -------------------------------------------------------------- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -----Original Message----- From: Rick Kingslan [mailto:[EMAIL PROTECTED] Sent: Friday, July 11, 2003 9:14 AM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] what to do with DMZ servers Right - understood.  But that only deals with the replication.  It doesn't deal with the (quite exaggerated) 50 bazillion other protocols and communication streams that DCs seem to think that they really need to survive without going completely schizo.   Ain't DC and AD and MS communication nuances FUN?!?!  ;-)   Rick Kingslan  MCSE, MCSA, MCT Microsoft MVP - Active Directory Associate Expert Expert Zone - www.microsoft.com/windowsxp/expertzone   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Roger Seielstad Sent: Friday, July 11, 2003 5:59 AM To: '[EMAIL PROTECTED]' Subject: RE: [ActiveDir] what to do with DMZ servers Actually, cross domain replication can be done via SMTP, which makes it a lot less messy.   Doesn't fix the underly, gaping security hole that exists, but at least you don't need to allow 100 open ports.     -------------------------------------------------------------- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -----Original Message----- From: Rick Kingslan [mailto:[EMAIL PROTECTED] Sent: Thursday, July 10, 2003 7:22 PM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] what to do with DMZ servers Are they daft or are they just convinced that there are no bad people wanting to own your domain?  And, if they implement this empty root/ two domain model, where will each of the domains live?  And the root?   Oh, my goodness.  Has anyone considered how absolutely horrific and difficult (OK - without turning your firewall into a cheese grater) the rules will be to deal with replication, etc to accommodate a domain in a DMZ?   Say your prayers now....   Rick Kingslan  MCSE, MCSA, MCT Microsoft MVP - Active Directory Associate Expert Expert Zone - www.microsoft.com/windowsxp/expertzone   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rogers, Brian Sent: Thursday, July 10, 2003 11:55 AM To: '[EMAIL PROTECTED]' Subject: RE: [ActiveDir] what to do with DMZ servers Have the exact same situation here.   We currently have a separate NT domain (for a security boundary) for our INET machines.  These machines exist on a DMZ...and run public internet sites that connect to a SQL backend inside our network.  An ISA server provides the firewall and proxy services.   Im currently having a fight with the operations staff on design.  They want to do the Empty Root/two subdomain model (because they read a lot of useless MOC Courseware books).    I can personally see very little benefit to consolidating these two separate domains into one forest.  They see no logic in having a separate forest/separate domain for the Internet systems.   Nothing short of a case study will sway them I believe....any decent documents comparing the two?  Or frankly..any documents that recommend a separate forest for your internet systems as a security boundary?   -----Original Message----- From: Raymond McClinnis [mailto:[EMAIL PROTECTED] Sent: Thursday, July 10, 2003 11:29 AM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] what to do with DMZ servers   I have a question... (Assuming that the Servers in the DMZ are already away from the in-house domain)   If before the upgrade none of the servers needed AD or access to your in-house domain, why would you want them to have it after the upgrade?    J Just thinking semi-logically...     Thanks,   Raymond McClinnis Network Administrator Provident Credit Union   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Roger Seielstad Sent: Thursday, July 10, 2003 7:19 AM To: '[EMAIL PROTECTED]' Subject: RE: [ActiveDir] what to do with DMZ servers   It would help if you determined what was going to be public access (via DMZ or otherwise) and determine the needs of the applications there.   The other option we've been talking about is AD Application Mode (ADAM) from Microsoft.     -------------------------------------------------------------- Roger D. Seielstad - MTS MCSE MS-MVP Sr. Systems Administrator Inovis Inc. -----Original Message----- From: Pelle, Joe [mailto:[EMAIL PROTECTED] Sent: Thursday, July 10, 2003 8:59 AM To: ActiveDir ([EMAIL PROTECTED]) Subject: [ActiveDir] what to do with DMZ servers Please help:   My company is currently migrating from an NT domain structure to AD...  I have some questions regarding how some of you went about hooking in your DMZ web servers to AD securely...  What DID YOU DO?!!!!!!  What are the recommended best practices?   The options we have discussed so far are: Option1:  Join DMZ servers to AD domain, open a half dozen ports on each server (Kerberos, LDAP, NetBios, etc) and lose the purpose of having a DMZ altogether. Option2:  Create a separate forest for the DMZ servers and create a one-way trust between our two forests.  Option3:  Stand alone DMZ servers not joined to any domain. All other options: ??????????????????????????????   Your suggestions are greatly appreciated!   Is there even a need to hook DMZ into AD?  I've heard MS talk about needing AD for apps like Sharepoint Portal...     Joe Pelle Systems Analyst Information Technology Valassis / Targeted Print & Media Solutions 35955 Schoolcraft Rd.   Livonia, MI  48150 Tel 734.632.3753      Fax 734.632.6240 [EMAIL PROTECTED] http://www.valassis.com/   This message may have included proprietary or protected information.  This message and the information contained herein are not to be further communicated without my express written consent.