I was wondering what would be the correct way to isolate servers in order to protect them and us from too much harm.
Let's have two scenarios:
1) Access to Application Server from the world
- an Apache Proxy distributes access to Tomcat application servers,
- Tomcat application servers, as well as
- DB servers accessed by the Tomcats.
What I would do:
- Put the proxy behind a first firewall.
- Put the Tomcats and DB servers behind a second firewall.
In that case if the proxy was hacked, no connections to the DB would be possible at least.
However, what is more probable? The proxying Apache being hacked or the Tomcat?
If this were e.g. an SQL injection issue, how would the proxy protect the Tomcat behind it? Probably not at all.
The question arises: aside from getting torn apart by an audit that would discover that there are no firewalls at all, what are we trying to protect anyway? In case the application layer is compromised I can put up all the firewalls in the world. They won't help.
2) Infrastructure services like syslog, dns, ntp, mail, you name it.
Servers in the DMZs may need those services.
One could put the syslog server in an own DMZ (let syslog in from anywhere but nothing out)?
In fact to be on the safe side you could put each server in its own DMZ but of course that again would be overkill... And what if the syslog server needs to send mails because it generates reports about the logs it carries?
What about DNS? Well you shouldn't need internal DNSs because you don't access internal resources. Everything internal you need to access you can use the IP or an entry in the hosts file.
What about NTP? One could make those requests out to the Internet...
Let's go, what do you think about these reflections and those 2 scenarios in particular?