metallica1973

[Log in to get rid of this advertisement]

I have a client that wants to save some money and would like to combine their e-mail server with squid/proxy server. I view that as a major security issue given that if the proxy server is comprised then then have access to their e-mail server as well. Can someone give me some feedback regarding the security risk in this type of setup.

unSpawn

Maybe fill us in on the network location, access use and proposed security measures of the machine?

teruzzi

Hello, yes I agree with you.
Normally the proxa server should be a part of the DMZ, the email server is to critical and should be protected by another firewall (for exemple put it in the normal server LAN).

To resume:
- for Proxy, one firewall level is enough;
- for e-mail, two firewall level should be used.

Saluti
MT

metallica1973

This is the network setup. you can clearly see that they dont have anything placed in a DMZ and just relying on VLANs. What would be the best way to secure this network with adding a proxy server?

unSpawn

You managed to answer one third of what I asked for (-access use, -security measures). VLAN's are Layer 2 "logic" while DMZ means (or should mean AFAIK) physical separation. However, clouding things over, in your OP you also stated that the client has money issues. Finally the question you ask here: ""secure" network utilising proxy?" is fundamentally different from your OP of "risk of combining proxy with MTA". So, all taken into account, if the (vulnerable) Mail Store must not be accessed from the outside then one suggestion could be to use a forwarding MTA in the DMZ. This forwarding MTA could be combined with a proxy since it only forwards e-mail and doesn't store anything. As an aside, maybe separating VLAN's by purpose (servers, users, guests) could make things more efficient (in terms of management) and help avoid mixing devices with disparate security postures.

metallica1973

So basically what you are trying to say is it would be better to place a forwarding e-mail server in the DMZ and configure the router/firewall to forward traffic appropriately. Would I place the proxy server in between the T1/ISP router and the Cisco 2811 or behind the 2811?

?