3

Say I have a website and a database, both hosted on rackspace.

Since all communication with the database is from the web server and not the internet, is it safe to assume that I do not need SSL like I do for communication that goes from internet to web server?

Improve this question
1
  • You will want to scale eventually, even if some traffic between the back-end and the front-end is confined to the trusted network now, it won't be always like that. Debugging SSL now looks like good investment of time. YMMV, of course. – Deer Hunter Mar 12 '13 at 19:47
4

SSL between machine A and machine B protects against evil people who can access the transport medium between A and B. In your case, you would need SSL if both servers share a network switch (or, worse, a hub) with some other, untrusted machines. Which may or may not be the case, depending on your hosting context. If both machines are connected to your own Ethernet network which is connected to the external world only through your router, then you might assume that communications between the Web server and the database are "physically secure", thus not needing SSL.

Improve this answer
2

Should I use SSL on my database server?

(Note: I will be using SSL synonymously for SSL/TLS)

I have no idea whether you should or should not but most likely, yes. Are you interested in securing the confidentiality of your transactions? Then use SSL. Is your database is on a separate system and has a public facing IP? Then use SSL.

There are some situations and network configurations where using SSL isn't as important (static routed IPs and the like), but it's still considered a best practice. Since you're hosting on a public provider odds are that you don't have one of those situations anyway.

Improve this answer
2
  • So even if the database does not have a public facing IP, I should still use SSL if I am interested in the confidentiality of my transactions? – Abe Miessler Mar 12 '13 at 19:49
  • 1
    I would say yes. Remember that your web server is on a public facing network and it is going to be broadcasting back to your DB in one fashion or another. I also suspect that your database does have a public facing aspect since you're getting to it from your web server, but I don't know how rackspace sets up their kit. It's possibly worth looking into how your services are structured but yes, I'd still recommend using SSL/TLS. – grauwulf Mar 12 '13 at 19:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.