0

If I have a system that consists of

  • an application server which responds to requests made only from the web server.
  • a web server that responds to client requests over the internet.

Is it necessary if I want to keep my data 'safe' to implement some sort of authentication between the two?

Ideally I would have these two physical machines connected in such a way that the application server is not connected directly to the public internet, only to the web server and then IP restrict requests so the application server only responds to the web server.

In reality each will probably be hosted on a VPS, so what's connected to what else is a null issue.

Is IP restricting requests considered safe enough in this case or do I need something stronger? If so, will a simple username/password combination be safe enough?

  • Most VPS providers let you create a private network, which is a slightly stronger control than IP restrictions. It is very common to connect web and app servers using a private network, and no authentication. – paj28 Sep 18 '15 at 10:04
  • 1
    would you lock your front door? - of course! would you lock your kitchens door? depends what's in there... – DaniEll Sep 18 '15 at 10:39
  • 1
    Consider this: What will happen to the application server if your web server is somehow compromised? – Jeroen - IT Nerdbox Sep 18 '15 at 11:18
  • 2
    @Jeroen-ITNerdbox - If your web server is compromised, the attacker can access your application server, just as the legitimate web server can. Doesn't matter whether you use authentication or not - the hacker has already compromised the web server, so they can grab the credentials. – paj28 Sep 19 '15 at 17:48
  • 1
    @LieRyan - if you don't trust your VPS provider, you're pretty much screwed. They can access your VM's memory and extract credentials, encryption keys, etc. – paj28 Sep 19 '15 at 17:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.