Publish school Intranet/VLE to be accessible over the web

[bicky]

Hi we have active directory domain with following Server 2008 R2 servers:

Server 1 DC+DNS+DHCP

Server 2 DC+DNS

Server 3 IIS - VLE/Intranet

Server 4 MS SQL - backend database for VLE

Server 5 ISA 2006 - Firewall

 

We would like to make VLE/Intranet accessible over the web; VLE uses ldap for the user authentication.

 

Can someone please suggest the best security measures.

 

If you have published your school intranet/VLE or web-server; what sort of security measures have you implemented?

 

Any help would be much appreciated.

[glennda]

Well Ideally you would want the Web Server in a DMZ but you could just get an IP Nat'd through to your internal network (on the ISA) with Port 80/443 open for Http/HTTPS access.

[deano]

What firewall do you use? If you had something like ISA or TMG, you could just publish the website

[Trapper]

TMG works a treat

[TheScarfedOne]

+1 for TMG/ISA here. Use it to publish Exchange, Sharepoint, and a load of other web services too...

[bicky]

thank you all for the information.

 

We have ISA 2006. Is there any security concerns I need to be worry regarding the ISA rules of publishing website.

 

Regarding DMZ:

Is it true/good practice that server's in DMZ should not have access to the internal network.

Now in my scenario I have SQL server in LAN; If I put web server in DMZ; how about the SQL.

[glennda]

thank you all for the information.

 

We have ISA 2006. Is there any security concerns I need to be worry regarding the ISA rules of publishing website.

 

Regarding DMZ:

Is it true/good practice that server's in DMZ should not have access to the internal network.

Now in my scenario I have SQL server in LAN; If I put web server in DMZ; how about the SQL.

 

Just allow the ports for Sql into the lan - reduces the risk

[Guest Guest]

Is it true/good practice that server's in DMZ should not have access to the internal network.

Now in my scenario I have SQL server in LAN; If I put web server in DMZ; how about the SQL.

 

That's the point in a DMZ. Just open the ports needed for the VLE to work; sql to your sql server, LDAP etc to your DCs.

 

If you were to have more than a couple of servers in the DMZ you may want to consider also having a DNS server in there. TBH with 1 server I wouldn't bother and either open that port up into your internal or just use google DNS with a hosts file for resolution of internal servers.

[bicky]

thank you all for the information