Actually, I wasn't being clear. It's not many processes. It's many instances of the same process. the process requires the db credentials, not each individual instance of it that is spawned.
The Client - App Server - DB Server - Web Server model is very common. I originally separated the App and DB servers to overcome DB licensing issues bfore they changed the license model. Back then, the DB vendors had this thought that everyone sat at their desk and directly acccessed the DB through a 24x80 screen. Client-Server stuff was a shock. Internet access was another shock.
What did come out of the whole thing was a better security model.
I'd add a DMZ machine configuration you described. the web server can be on the same level as the DMZ, but the app and db servers should have all traffic to/from them routed through the DMZ. Use encryption and non-standard ports in/out of the app and db servers as well.
The Oreilly Firewall book is very good and covers some inexpensive DMZ based solutions. The basic concept is to totally remove your app and dp from web space Only specific processes with specific credentials coming in on specific ports, using specific protocols can access specific things on the app and db servers.
IIRC, redhat, or some other linux vendors have "DMZ in a box" type solutions. I used BSD, but it requires some knowledge of IP chains and IP spoofing.
Topic Options
Post Options
Thanks(0)
