2

I have a SQL Server placed in DMZ and I want to give access to internal users (and VPN clients) to use SSMS to remotely connect to it via port 1433 so server will accept the connection only form defined IP sources over this port, is it a safe approach for a production server?

2
  • 1
    I would not have any SQL Servers in the DMZ. Period. May 7, 2015 at 17:42
  • 1
    I have a single server that hast to serve as Web Server and also has to manage database task, what is you suggestion then?
    – Fred Jand
    May 7, 2015 at 18:13

1 Answer 1

1

First let's answer your initial question then your follow up question.

I would go further and: change the SQL Server port to a non standard one, turning off the SQL browser service, renaming SA, turning on the firewall on the local machine not to accept any connections on the SQL Server port outside of your internal IPs, and have all of your traffic hit the web server which serves as a secured abstraction layer for outside connections.

Follow up question: How about HyperV and setup one server for SQL internally and a second one for the web server in the DMZ? Why does the web server need to be in the DMZ? Are you able to just forward all 80/8080/443/etc. ports over to that web server?

BTW, since you have both on 1 machine, have you set 'max memory to use' options in SQL Server and 'lock pages in memory' so IIS doesn't steal precious RAM?

5
  • 1
    Thanks for answer This is a very basic sever (configuration wise, it is a VM located somewhere (that I don't know where), with very low amount of memory and very low hard drive capacity) but the load will be very very light on it and there are no concerns about that (indeed I have no access to change any of the setting you have mentioned) Why DMZ, because of the IT department decisions which I have no control over. ...
    – Fred Jand
    May 7, 2015 at 21:30
  • 1
    Why DMZ, because of the IT department decisions which I have no control over. this server does not have route-able IP, so 80 and 443 ports are NATed to receive HTTP and HTTPS requests from inside/outside of company network, no more ports will be exposed to outside but on the other side of the wire, local network has access to some other ports to do development tasks, one port for deployment already opened and and one for RDP. I don't think that changing the default port is necessary since eventually this will be moved to Azure which only supports 1433 for SQL Database.
    – Fred Jand
    May 7, 2015 at 21:31
  • 1
    Indeed I do not have access to open the port 1433 on the server, I need to ask IT to do it but I wanted to be sure that it does not cause any serious issue. Currently we have to RDP to the sever to work with sql sever. note that this port 1433 will only be opened toward internal network not internet. So according to these details are there any security concerns here?
    – Fred Jand
    May 7, 2015 at 21:31
  • 2
    Port 1433 only open internally and behind 2 layers of security (windows firewall and NAT/Router Firewall) Check. Other ports and remote mgmt locked down: Check. I feel you have enough compensating controls assuming you're not bound by PCI/HIPA/SOX or other major compliance requirements. In those cases, you'd want to document all of your compensating controls and write some policies around it. I personally would be fine with this implementation with your current constraints. May 7, 2015 at 21:51
  • Thanks, I'll ask IT to open the port, the rest is on them.
    – Fred Jand
    May 7, 2015 at 23:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.