How do you manage your DMZ server accounts?

humbletech99 · 07-23-2009, 10:27 AM

I'd just like to know what you use for user account management on your DMZ servers?

Do you use the same authentication realm as internally?

Do you use a different authentication realm, perhaps only for the DMZ?

Do you use local accounts?

acid_kewpie · 07-23-2009, 12:45 PM

On my current project we use local accounts, but I'm pushing to move to using a read-only replica LDAP server within that zone to map back to. This means that a subset of passwords and accounts would be known to be the same inside the DMZ as in the back end, but as that's already more likely to be the case by manual intervention, I don't consider it to be a risk personally, or at least, a risk worth facing. A DMZ specific domain wouldn't be disasterous either (again with only read only boxes in the DMZ itself...)

custangro · 07-23-2009, 12:53 PM

I use LDAP

humbletech99 · 07-24-2009, 04:04 AM

That's what I am working on doing right now, I think I want to make the replicas read only but I am not sure quite how to make sure of this, is it updateref or something to prevent writes to the replicas when clients connect or do I just use acls to deny writes to all clients on the replica slapd configs?

acid_kewpie · 07-24-2009, 05:35 AM

Having an entire ldap server read only without any room for manoeuvre makes things conceptually very simple, with much less chance of abuse. You can easily just run a vm with the master server on an internal system and shut it down when not in use.

cam34 · 07-30-2009, 11:27 PM

Quote:

Originally Posted by humbletech99

That's what I am working on doing right now, I think I want to make the replicas read only but I am not sure quite how to make sure of this, is it updateref or something to prevent writes to the replicas when clients connect or do I just use acls to deny writes to all clients on the replica slapd configs?

it will something like:

access to *
by uid=dmzuser,dc=linux,dc=com read

Which is the last ACL of slapd.conf anyway
The syntax is incorrect but you get the idea

humbletech99 · 07-31-2009, 03:17 AM

yes I've used a lot of acls and have done something similar but I've also set the readonly on as well, defense in depth and all that...

acid_kewpie · 07-31-2009, 03:12 PM

is that a generic user account for all admins? I really really hope not...

humbletech99 · 08-04-2009, 03:57 AM

acid_kewpie, have you used ldap for pam/nss configuration? You need to have one account that can read entries, although you can tighten it a little, but you still need read for a general user otherwise your directory would be read only to all which would suck big time, especially for a DMZ.

acid_kewpie · 08-04-2009, 06:07 AM

I'd only have an account for replication purposes within the DMZ LDAP, there should be no write access to anyone else.

humbletech99 · 08-04-2009, 06:13 AM

You still need an account for nss/pam, otherwise your whole directory is anonymously read enabled (bad). Of course write access is denied to all, hence the read bit at the end of the mentioned acl example.

One problem is the number of inept guides to openldap out there, which has led me to read a huge amount of documentation from multiple sources to piece it all together.