2

I'm wondering what are the drawbacks, from a security point of view, of having more than one service (let's say the web server, the mail server and the DNS server) on the same machine, rather than having those services split on more machines?

We can also assume I have a backup DNS and mail server, so if the machine goes down, I can switch to the backup services.

EDIT:

What are the pros and cons of having these services on different machines? Are the advantages of the second solution (services split) whorthwhile for spending more money and time (properly configuring those machines) on splitting those services on different machines?

  • Are they different VMs on the same physical machine? Or multiple applications in the same OS installation? – CodesInChaos Jan 31 '17 at 10:58
  • They are multiple applications on the same OS – JiBlBL Jan 31 '17 at 11:07
4

Other then the amount of resources all these services on one machine will take up, you will need to worry the most about one of them being compromised.

In this situation, when one service is compromised they all are. Any attack on one of them is an attack on all of them.

If you have no other choice and have to have all of them on the same machine, make sure to harden the machine correctly (user restriction, different password and usernames for each service, limit what your services talk to and so on...).

We can also assume I have a backup DNS and mail server, so if the machine goes down, I can switch to the backup services.

That's nice but do you really want to get to that point? And what if it was an exploit that can be used also on this version of your machine/service? But do make sure to always have a backup, just don't use it as an excuse for weak security.

  • Thanks for your quick answer. I edited the question in order to consider the pros and cons of the two solutions. Could you please complete your answer with those? – JiBlBL Jan 31 '17 at 10:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.