What are the security issues of having all services (web, smtp, dns) on a single machine?

Question

I'm wondering what are the drawbacks, from a security point of view, of having more than one service (let's say the web server, the mail server and the DNS server) on the same machine, rather than having those services split on more machines?

We can also assume I have a backup DNS and mail server, so if the machine goes down, I can switch to the backup services.

EDIT:

What are the pros and cons of having these services on different machines? Are the advantages of the second solution (services split) whorthwhile for spending more money and time (properly configuring those machines) on splitting those services on different machines?

Answer 1

Other then the amount of resources all these services on one machine will take up, you will need to worry the most about one of them being compromised.

In this situation, when one service is compromised they all are. Any attack on one of them is an attack on all of them.

If you have no other choice and have to have all of them on the same machine, make sure to harden the machine correctly (user restriction, different password and usernames for each service, limit what your services talk to and so on...).

We can also assume I have a backup DNS and mail server, so if the machine goes down, I can switch to the backup services.

That's nice but do you really want to get to that point? And what if it was an exploit that can be used also on this version of your machine/service? But do make sure to always have a backup, just don't use it as an excuse for weak security.