Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 5 replies
  • Answers 1 answer
  • Subscribers 4 subscribers
  • Views 12990 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

authentication LDAP IN DMZ

Adel Hamdi pacha

HI ALL , I have a new UTM  SG310

 I have 1 server FTP and WEB   installed in IIS  in DMZ

 and  I have  server AD active directory  2012 r2

I want the user member of domain can connected to FTP server  with  authentication LDAP in internal  and external  what solution or rule to created ?

This is the first time when using the Sophos product our old appliance is cyberoam

please help me. thank you



This thread was automatically locked due to age.
Parents
  • 0

    If you use ldap authentication from dmz servers to domain controller, you only need to open one port, 389 for cleartext or 636 for TLS encrytion (preferred but requires a trusted certificate).  This also means that the dmz servers do not need to ne joined to tbe domain.

    Remember that ftp is unencrypted,  so you should not solicit login credentials or transfer senditove data unless the protocol is sftp or anofher secure protocol.

Reply
  • 0

    If you use ldap authentication from dmz servers to domain controller, you only need to open one port, 389 for cleartext or 636 for TLS encrytion (preferred but requires a trusted certificate).  This also means that the dmz servers do not need to ne joined to tbe domain.

    Remember that ftp is unencrypted,  so you should not solicit login credentials or transfer senditove data unless the protocol is sftp or anofher secure protocol.

Children
  • 0 in reply to DouglasFoster

    The other problem with authenticated remote access is that there a lot of smart bad guys who are busy doing password-guessing attacks.   You really need to have 2-factor authentication for remote access.   It is definitely required by PCI DSS for anyone who takes credit/debit cards.   You can implement 2-factor with UTM using either WAF (Webserver Protection) or SSL VPN in front o of your DMZ servers.   WAF, of course, would require converting your file share from ftp to https.

  • +1 in reply to DouglasFoster

    HI all , Thanks to you all I have to search on Internet I found several solutions like the RODC in the DMZ and ADFS also, I will choose the most secure solution is to Separate the FTP server from the DMZ and put it in the local
    Used the user portal, vpn SSL client
    Join UTM to the domain and authentication through the UTM and DC. This is the best solution I think.
    Thanks to all

Unfiltered HTML