Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 5 replies
  • Answers 1 answer
  • Subscribers 4 subscribers
  • Views 12997 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

authentication LDAP IN DMZ

Adel Hamdi pacha

HI ALL , I have a new UTM  SG310

 I have 1 server FTP and WEB   installed in IIS  in DMZ

 and  I have  server AD active directory  2012 r2

I want the user member of domain can connected to FTP server  with  authentication LDAP in internal  and external  what solution or rule to created ?

This is the first time when using the Sophos product our old appliance is cyberoam

please help me. thank you



This thread was automatically locked due to age.
Parents
  • 0

    If you use ldap authentication from dmz servers to domain controller, you only need to open one port, 389 for cleartext or 636 for TLS encrytion (preferred but requires a trusted certificate).  This also means that the dmz servers do not need to ne joined to tbe domain.

    Remember that ftp is unencrypted,  so you should not solicit login credentials or transfer senditove data unless the protocol is sftp or anofher secure protocol.

  • 0 in reply to DouglasFoster

    The other problem with authenticated remote access is that there a lot of smart bad guys who are busy doing password-guessing attacks.   You really need to have 2-factor authentication for remote access.   It is definitely required by PCI DSS for anyone who takes credit/debit cards.   You can implement 2-factor with UTM using either WAF (Webserver Protection) or SSL VPN in front o of your DMZ servers.   WAF, of course, would require converting your file share from ftp to https.

Reply
  • 0 in reply to DouglasFoster

    The other problem with authenticated remote access is that there a lot of smart bad guys who are busy doing password-guessing attacks.   You really need to have 2-factor authentication for remote access.   It is definitely required by PCI DSS for anyone who takes credit/debit cards.   You can implement 2-factor with UTM using either WAF (Webserver Protection) or SSL VPN in front o of your DMZ servers.   WAF, of course, would require converting your file share from ftp to https.

Children
No Data
Unfiltered HTML