There are several ways to skin the DMZ cat.
In the environments that I have deployed SME I have found that there is a huge confidence/skills gap i.e. the users/local admins do not have the skills to back up the things they want to do in a secure fashion.
In those environments I have the utmost confidence that SME prevents them from doing themselves any harm. If they require anything that needs a DMZ it is usually possible to provide something that works for them by using a router and some thought.
Everyone's environment/market is different, in the UK we can get a dsl connection with a routed 8ip subnet for the same price as a dynamic address from some providers, add in a nat router for another £50 - £200 (depending on what else they want) and you can port forward or have real IP addresses or a mixture of the two for all of your stuff.
The setup I run has 16ips from Zen Internet, I have a Draytek 2600 router with port forwarding for ip cameras and sip, I use the web interface for the router to set up port forwarding to individual pcs when I need to vnc/remote desktop in to another machine. My SME 6.01 server has a real ip as does my SME 7 test box, my SSL Explorer test box and my m0n0wall hotspot project.
I have no need for a DMZ as described above, I've just done everything differently.
As Darrell says above, enterprise users have probably already got enterprise style firewalls - Watchguards or Zylabs or something else.
Smaller businesses or soho users are necessarily more constrained, but as requirements grow and there are investments to be made, the choice between buying a router for £200 or hiring a sysadmin for £25,000 (or a consultant for £100 per hour) becomes easier. Its not that it can't be done or even whether it should/shouldn't be done, its that there are more factors to consider than the computers.
I consider SME to be like velcro - fantastically simple to use, life changing for many and a credit to the developers. I deploy it fearlessly where I know users will always click on the yes button in a dialog because they haven't read it and know that it will save them from themselves. I deploy it in other environments where the integration between the various parts are needed - user creation in seconds, email aliases controlled by a non-skilled admin, pptp vpn on a per user basis and so on.
The newer server virtualisation technologies may well overtake clustering and failover - the hardware will have redundancy with virtual servers isolating the OS from the hardware, the physical hardware hosting an SME could be changed without rebooting the OS.....
Costs are always the big thing. What is meant by redundancy? High Availability clustering is not the same as dr redundancy. Typically for HA hardware is in the same place and can survive an IT fault, typically for DR hardware is in different places and is designed for a rapid return to service after a catastrophic disaster rather than an instant recovery of in progress transactions. When you factor in datacentres and terabytes of data you have to agree that you are not talking about two-bit operations with minimal staff, the hardware costs a fortune to house, let alone purchase, configure and run it.
There are ways to achieve redundancy without spending much money, regardless of the os you use.
1. Configure backup MX records in your DNS and have mailservers which will queue your mail for you in the event of a problem.
2. Have two servers that rsync in the middle of the night and run indcremental or differential backups during the day that you take away with you at the end of the day. Make sure that your configs are documented so that you can absolutely recreate a server which gets stolen or otherwise 'removed' from service.
3. Configure DNS with host aliases so that you can switch between the servers by assigning the alias to the other server.
Alternatively spend megabucks and go the SAN route - Invest in iSCSI equipment (or push the boat out and go with fibre channel HBAs and FC or SCSI storage). Use the SAN management tools to take snapshot backups and replicate data away to tape.
I may have lost my way through this, the point I'm trying to make is that there are many ways to do a DMZ, achieve redundancy and maintain uptime, all with different associated costs. In my experience SME embraces most of them through various how-tos and contribs, most times users want something which they don't understand, when they explain what they want it can usually be delivered another way.
Regards
David.
David
12 Replies
7108 Views