0

If I have a system that consists of

  • an application server which responds to requests made only from the web server.
  • a web server that responds to client requests over the internet.

Is it necessary if I want to keep my data 'safe' to implement some sort of authentication between the two?

Ideally I would have these two physical machines connected in such a way that the application server is not connected directly to the public internet, only to the web server and then IP restrict requests so the application server only responds to the web server.

In reality each will probably be hosted on a VPS, so what's connected to what else is a null issue.

Is IP restricting requests considered safe enough in this case or do I need something stronger? If so, will a simple username/password combination be safe enough?

9
  • Most VPS providers let you create a private network, which is a slightly stronger control than IP restrictions. It is very common to connect web and app servers using a private network, and no authentication.
    – paj28
    Sep 18, 2015 at 10:04
  • 1
    would you lock your front door? - of course! would you lock your kitchens door? depends what's in there...
    – DaniEll
    Sep 18, 2015 at 10:39
  • 1
    Consider this: What will happen to the application server if your web server is somehow compromised?
    – Jeroen
    Sep 18, 2015 at 11:18
  • 2
    @Jeroen-ITNerdbox - If your web server is compromised, the attacker can access your application server, just as the legitimate web server can. Doesn't matter whether you use authentication or not - the hacker has already compromised the web server, so they can grab the credentials.
    – paj28
    Sep 19, 2015 at 17:48
  • 1
    @LieRyan - if you don't trust your VPS provider, you're pretty much screwed. They can access your VM's memory and extract credentials, encryption keys, etc.
    – paj28
    Sep 19, 2015 at 17:50

0

You must log in to answer this question.

Browse other questions tagged .