I've got the following situation: A web server located in a DMZ receives file uploads from web browsers. The uploaded files are stored on the web server's file system. In the next step, these files must be forwarded to another server (let's call this the internal server) in the internal network. For the last step, the internal server needs a traditional file access. I would like to discuss some solutions:
Web Server accesses a shared file system on the internal network Pros: Simple, files are stored and accessed from both machines with SMB/CIFS Cons: Pretty dangerous to allow a SMB/CIFS access (I remember all the bad Windows bugs in the past) in the internal network.
Install some kind of a custom service on the internal server, web server get's a client to send the data. Could be FTP or some custom implementation. Cons: The installed service may not be safer than the shared folder.
Shared folder in the DMZ, only accessible from the internal server. Pros: from 1. Cons: ?
Do you see points I forgot or another completely different solution?
Note: A "control channel" from the web server to the internal server exists, thus, the web server can send a "load new data from this directory" command to the internal server.