I'm posed with a situation where i am uncertain which way to go. We have 2 Virtual Machines set up at a host that'll act as a webserver and a database server. Obviously, both will have to communicate with eachother. Now currently the way that it's set up is that they both communicate over their ext. ip's. (so we query the ip of the database server from our webserver). However we feel like this isn't very secure.

So far what i came up with is to set up a OpenVPN server on the Database server and a OpenVPN client on the webserver. Set OpenVPN up to use private IP adresses and reroute all traffic through the VPN tunnel. I think it's fairly secure but quite honestly i don't really know. Also i don't really know how this would turn out in performance. We don't want to sacrifice too much performance on this.

Anyone have any ideas if this is a good set up ? Or anyone have any other ideas how to achieve a better result ?

Thank you.

  • 1
    You could put both VMs on a VLAN provided by the virtualisation solution. That would be secure (traffic will only go between the two VMs, plus simpler to ensure your configuration can't leak info, like the OVPN connection going down and traffic taking another route) and not sacrifice any performance. – deed02392 May 2 '14 at 8:10
  • Why are you concerned about this? What is it about your environment that leads you to want to encrypt your traffic? – GdD May 2 '14 at 8:27
  • We're planning on storing data on the database server that could potentially be sensative. @deed02392 putting the VM's on a VLAN is a good idea, didn't think of that myself yet. I've asked the host if they can arrange for this. – Jdeboer May 2 '14 at 8:59

If two machines (virtual or not) must be made to communicate with each other, then establishing a VPN between them cannot harm; by definition, the VPN aims at emulating an isolated set of wires between your two hosts (hence presumably free from hostile eavesdropping and interference) so that arbitrary traffic between the two machine becomes "secure". OpenVPN has good reputation and is free, so using it is not a bad idea. Alternatively, if the applications which must talk to each other can handle their own security (say, SSL), then that is also applicable; the VPN, though, is probably simpler to set up, and more comprehensive.

As others have said, if your machines are VM, then the cloud provider is God: if he wishes so, he can technically see all your secrets and alter them at will. The provider is thus trusted. So the provider cannot be an attacker, and must be assumed not to fall under hostile control. Under these conditions, if the provider can set up a "private link" between your two machines (a VLAN, indeed), then that's fine. The security of the VLAN is strong as long as the actual wires and routers of the provider's network are clean and honest, which is, as I just wrote, a core assumption of the Cloud model.

Now, of course, there can be a subtle difference between "the service provider is honest" and "the service provider is honest and competent". A small configuration mistake (the dreaded human error) can put third party systems onto your VLAN. There again, running your own VPN can add protection against the provider's vagaries (it would not stand against provider's malice, but incompetence is much more common than wickedness).

Edit: I forgot the classic argument about performance. It goes thus:

  1. Performance issues do not exist.
  2. Performance issues do not exist until duly measured.

So if you fear performance issues, then the only sane way is to try, and see if the fears were justified or not. One can make a priori estimates but this requires some intimate knowledge of both the behaviour of involved algorithms and of network protocols and latencies; you cannot realistically hope to get decently accurate estimates unless you are highly competent in cryptography, low-level programming and TCP/IP internals. Trying out and quantifying issues is a much better way; more often than not, alleged performance issues happen to be non-existent (but other, unpredicted performance issues may unexpectedly appear). If you want to make benchmarks on OpenVPN, you should first read what has already been done on the subject, namely this page.

  • Thanks Tom, we're currently reviewing the choice to either go with OpenVPN or have the VLAN set up. I think people are more eager to go for the VLAN option as they're afraid that the OpenVPN solution will decrease performance. This has been very helpfull and insightfull ! – Jdeboer May 2 '14 at 11:31
  • Oh yes, I forgot the usual advice about performance. I'll add it ASAP. – Tom Leek May 2 '14 at 12:12
  • Going through the documentation right now, thanks for that ! – Jdeboer May 2 '14 at 12:47

What is your threat model? What are you protecting against? Where are the VMs located?

Assuming that the VMs in question are ones you host on machines you own instead of cloud instances like EC2, encryption between the web server and database server is almost definitely overkill. You can simply place the servers in your internal network and only allow the web server to query the database. Sure, an attacker that manages to crack your defences and gain access into your internal network can sniff the traffic, so you will have to weigh that threat against the cost of encrypting the data and decide if it's worth it.

  • I don't have a threat model at hand, not even sure if there's one right now ^^'. We're mostly just looking to prevent querying our databases over an open connection because, and this answers quesion 3, the VM's are located on a Cloud Instance. (not amazon though.) And the host simply provided us 2 machines and 2 public IP's. And as such we're assuming that if we start querying our databases we'd be doing so over an insecure connection. (i'm pretty new to most of this so i'm just trying to get informed) I think adding both machines on a VLAN might offer a solution so we asked our host to do so. – Jdeboer May 2 '14 at 9:57
  • @Jdeboer You need to develop a threat model so you know exactly what you want to protect against. Ok, you are using cloud instances. In that case I would encrypt the data instead of relying on the service provider for anything. Many databases like MySQL offers connections over SSL. Is that an option? – Ayrx May 2 '14 at 10:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.