Hi,

I will be setting up Apache web server in DMZ and Oracle web server (Windows) in LAN. The requirement is to allow logged in visitors to view / change their details via the web site.

What is the best way to configure this. Is simply allowing web server's ip to communicate with oracle server's ip (and the oracle port) is secure enough or is there a way to do this more securely?

Thanks

Yea the best way to do it it is write your application PHP, Java, whatever your applications is based on and only allow the IP of the apache server to talk to oracle by Oracles port., Since the DMZ and LAN are presumably Internal to your company I would't bother with anything else as long as you have a good firewall. If however, the DMZ is outside your network and or not behind a firewall I would suggest maybe an encrypted tunnel too.

I would go a step further, and not only restrict the IP address through the DMZ, but the allow ports, too. Since this is going to be outward-facing, I'd run the Oracle listener on a non-standard port, then allow that port:IP address through your internal firewall, to talk to the box in the DMZ. If you open up the entire address, then you give a potential attacker much more to work with.

Actually you could use SSH tunneling to forward the appropriate port from the Oracle machine to the DMZ. That way the Oracle server only has to allow SSH and the DMZ programs could communicate with localhost.

Got me on that one Hangdog, you are right only allowing SSH might even more secure, but is it really needed if he controls the DMZ and LAN network?

I guess it depends on your level of paranoia. Personally I view the DMZ to be pretty much the same thing as having it out in the wild on a completely separate network.

Of course the real problem here is that no matter how you secure the communication between the DMZ and Oracle machines, it still exists and is technically exploitable. With any of these solutions, if the DMZ machine gets cracked, the bad guys will likely be able to see the Oracle machine. So a big part of keeping this secure is making sure that the DMZ machine is seriously hardened.

Well that's what all of technology is about, you have to sacrifice some security for usability.