Should I enable domain authentication in my DMZ

Question

Traditionally at my place of work we have an internal subnet that is completely protected behind our firewall. No ports are allowed to be opened to direct connections from the public network. We also run a DMZ where we only allow specific ports to be opened as they are needed. In addition, we don't allow connections to the internal network to be open from the DMZ, but the internal network can open connections to the DMZ. I would hazard that this is a pretty traditional DMZ-stlye configuration.

We also host our domain controllers in our internal network. Up to this point, the implication of this has been that we need to manage DMZ password separately since there is no AD authentication. This hasn't been a big deal since we have only had a handful of DMZ servers.

Now we are about to launch a product that will require significantly more DMZ servers, and during the last phase of our testing we have already had issues with password management on the DMZ systems. The solution would seem to be to punch the hole from the DMZ to the internal network to allow for DMZ servers to be joined to the domain.

For me this raises 2 questions:

1. Is this even a good idea?
2. Assuming that it is not a terrible idea, is it better to allow specific routes for each server to get back to the domain controllers, to allow the entire subnet to get back, or to deploy a DC on the DMZ and only allow that server to get back through.

I'm hoping that someone out there has some thoughts.

Answer 1

1) Clearly not a good idea. That would mean that if a DMZ machine that is joined to the domain is compromised, then your corporate AD would be in danger, which isn't acceptable

The only option is to deploy a separate Active Directory forest for your DMZ, potentially with different zones; for example, the main writable domain controllers in an isolated network segment and read only domain controllers in the other segments, but in any case without a link to your corporate AD.

There's indeed a management/administrative overhead, but security wise you don't have many other options.