Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

Scenario

We're working on putting a FIPS 140-2 compliant SQL database on a dedicated machine behind the internal firewall of an organization, and need the capacity to push a specific document or record to an external organization in an ad hoc manner. EG: notify "Zap Labs" that a specific file is awaiting download, then "Zap Labs" can authenticate and retrieve it.

The Problem:

I have very little experience, but pretty solid theoretical understanding. It has to operate on Windows Server, but I can prototype it using OS software on Linux or BSD to get a feel for what needs doing and work from there - I'm trying to understand more right now than implement.

The Question:

What's a good resource on installing and configuring an authenticated login over HTTP? I know there are some serious issues with web app vulnerabilities that need to be considered and I am not familiar with them. Also I figure confidentiality will be ensured via HTTPS(SSL), but I have literally zero experience with how I might actually set that up.

Also, how should I manage the connection between the database and the DMZ web server? I can think of a couple ways this could be done, but none of them seem secure.

Thanks.

share|improve this question
2  
Andrew, this is a broad question. TL;DR - yes, you need a HTTPS connection with client certificates, and an encrypted link between the web server and its DB back-end. Depending on your threat model and whether you really feel paranoid, you may need to have secure e-mail messaging with extra noise added, to perform notifications. – Deer Hunter Feb 19 at 16:52
I managed to get all of that covered except the encrypted link between the web server and the DB back-end. I'm not sure how to implement that in PHP. – Andrew Feb 24 at 5:17
1  
There is no such thing as "a FIPS 140-2 compliant SQL database". FIPS 140-2 is a standard for cryptographic modules, and there are a variety of ways a database might use them. (I don't know about PHP. Knowing what database server are you using might help someone who does suggest something.) – armb Apr 8 at 13:36

1 Answer

up vote -1 down vote

Maybe this document about using SSL to connect to MySQL database will help: http://dev.mysql.com/doc/refman/5.0/en/ssl-connections.html

share|improve this answer
And at the other end php.net/manual/en/mysqli.ssl-set.php stackoverflow.com/questions/3657765/… But that only helps if he's using MySQL. – armb Apr 8 at 13:43
1  
Link-only answers are not useful here and tend to get deleted. Can you expand the answer please. – Rory Alsop♦ 16 hours ago

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.