donavon
So I guess you are saying you don't believe in the model of having the firewall on the same DC server, despite the fact that the sme firewall is every bit as effective as any other firewall, whether seperate or "built in".
The security model of a seperate firewall in front of your server, is as good as how many ports you forward to your web server and what applications you run on your web server (and how vulnerable they are to hacking).
No firewall (wherever you put it) will stop a "buggy" web application getting hacked.
The merits of firewall "location" has been discussed many times before in these forums, and it seems to be a two camp scenerio, some will only use a seperate firewall, some are quite happy to use the sme firewall.
Let's not restart this discussion as my post is not meant to be a rehash of that argument.
I'm simply saying that sme used appropriately is very safe and secure, and I believe that one server will suffice your needs (assuming the scale of your activities is moderate and we are not talking thousands of users etc etc).
In the real world, thousands of sme servers are configured in server gateway mode and run as domain controllers without failure and without security ramifications, over many many years now, ie they are "exposed" directly to the Internet via a bridged modem and reliant upon the sme firewall.
This is a proven fact.
I personally have had a number of sme servers running in that mode since the days of sme 3.x and the firewall has never been breached in eight years.
The developers have given great attention to the security of sme server.
I'd suggest you reappraise the need for seperate servers as it is simply not necessary.
This is all apart from the fact that no current simple or supported mechanism exists for implementing the user authorisation functionality you ask for. True, it is a very desirable "feature" and many people have requested it over the years, but it is also complicated to implement, and "out of scope" of the main sme server project.
Charlie Brady gave some indication of the steps required to achieve this functionality a few years ago, I think in a devinfo list post, but a lot of work would be needed to develop the code and methodology, and that would need financial sponsorship to have the code developed.
If it is really important to you ie a "must have", then contact Charlie to discuss funding the development work, and the outcome would be a wonderful gift to the whole sme user community.
Work is being done on LDAP authentication, more so related to sme 8, which is still in beta stage, as a workaround that may be sufficient for your needs.
Perhaps the old procedure outlined earlier in this thread is still functional.
If you have only a few users then the simple answer is to manually replicate the user base on both servers.
15 Replies
3088 Views