1

I have a corporate web portal which is used for staff collaboration including a web-based mail interface connected to MySQL Database, corporate calendar, file storage, customer contacts data with phone numbers and emails and all kinds of other data. Of course some of that data is sensitive as it relates to internal corporate matters as well as customer privacy.

The whole site is written on PHP+JavaScript with MySQL database on Ubuntu (Apache). I have chased up all the code and replace all SQL statements on Prepared Statements to prevent SQL Injections. None of the web forms allowed to users to submit HTML data, only pain text, I also don't store HTML into MySQL tables to prevent Cross-Site Scripting. I put a brute-force defense by delaying next attempt for a user after typing a wrong password. The authorization done in two steps with user first typing his/her name and password and then the system sends SMS to that user with an authorization code. The whole site works over HTTPS only and connected to internet through a firewall which permits only 443 port for incoming connections, i.e. no FTP, samba, no external MySQL connection or any other services are available. The main page of the site is empty and Search Engines can't even find a login page to index so if one doesn't know the exact address he couldn't even start an authorization process. I don't know of any other ways to hack it.

However I was trying to get a consultation from a security specialist and despite all the measures taken he insists to connect any external clients over VPN client (L2TP IPSec) which is integrated in any modern Windows or Linux Operating Systems. Since this is not a public site I could do that but that will take additional work with the clients to explain each one on how to connect and give them one more login-password pair. I was also told that PHP originally being a Personal Home Page language with no attention to security still might have vulnerables and security breaches. He couldn't give any examples. I wonder if those are really exists and what are they? Would I really increase the security by switching the clients to the VPN access instead of direct HTTPS or it will just uselessly bother them?

UPDATE (a month later)

After playing around with VPN tunnel and VPN clients I don't think it is a good idea to create a VPN tunnel over HTTPS because what I just have is WEB server with HTTPS behind NAT I have all ports blocked except 443 so the only think a user can do is to access that.

If I create a VPN channel I let users to access my local network so they have access to the NAT router from inside (from LAN ports) and they have access to the whole server which plays role of the WEB server. So a malicious user who hacked VPN login/password and got inside LAN i.e. got behind the NAT and he can now start hacking not only the server on all ports but also the router. To prevent that I need another firewall and probably another device to create virutal LANs.

Does it really worth it?

More on netwrok diagram

As to the netwok diagram the local server has two network interfaces: one for internal network and other for Internet connection.

The Internet going into that local server through two NAT points:

1) The Internet connection goes from the external IP through Windows Server 2008. That Windows Server shares the Internet connection to people in office and also it has RRAS set to forward port 443 to one of the local addresses (let's say it goes to 192.168.0.100). There is also 3rd party firewall allowing incoming connections only on 443 port.

2) Then I have a router on that local address (192.168.0.100) which can handle VPN tunnels of just port forward futher. For right now it only forward port 443 to its LAN which the local server is connected to. That makes the local server separated from all the other computers that is getting internet from the Win Server 2008.

Separately from that there is a whole independent network with no internet connection. The local server is part of it using it second network interface. There are no any routers there, only a switch.

1

I apologize in advance, the layout described is a bit hard for me to follow without a network diagram.

I can understand your security personnel's concerns with this site being exposed to the internet.

While it sounds like you've gone to great lengths to ensure your code is secure, the web server and OS itself are still at risk of being exploited should a vulnerability be discovered.

It also sounds like this website has access to some key pieces of data and infrastructure.

I'm having a difficult time discerning if any of these servers are in a DMZ, or if the servers all reside on the internal network?

If the components reside on the internal network there is no way I would expose this site to the internet.

I would recommend a VPN solution that utilizes two factor authentication for logins to the VPN. (preferably a hard token)

Also, the fact that your website doesn't doesn't display a default page should not be considered a security feature. You would be surprised what a web crawler can find. :)

For example, the next site that any user accesses directly after visiting your site will be aware of it via the referrer header.

  • Thank you very much for paying attention to my question. I have updated it with a netowrk diagram description. – user164863 Feb 19 '14 at 8:52
  • The referer header will only leak data if this secure server have a link pointing to the external site. – ThoriumBR Oct 17 '14 at 12:50
1

In your case I would recomend a VPN server. This appears to be a very secure site, and you hardened the server side very well. Using a VPN infrastructure will put another barrier between the server and the attacks.

If you already have the users receiving and entering the authorization code, they will be able to connect to a VPN without much trouble. In my shop we have FortiGate VPN, and there's even a browser based client. If you implement something like this, your clients will be only needed to access one website before connecting to the secure server.

As a sidenote, PHP is a recursive acronym and means PHP HTML Preprocessor, not Personal Home Page. They take security seriously, but every software has its bugs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.