Microsoft SQL and IIS on the same server

Hi everyone
I have heard this said by people in passing but am trying to confirm it. Are there any security issues with putting MS SQL 2000 on the same server as IIS (current version)? I have googled around and checked out some other sources and haven't been able to find out a definitive answer. The best I have been able to determine that there is a may be problems based upon the patching level and the particular configuration.

What I would like to determine is:
1. Firstly is it best practice to undertake this sort of configuration or is it something to be avoided at all costs

2. Is it simply a case of maintaining current patching levels and careful configuration to avoid any problems.

Regards

Tek

It's a matter of how much risk you are willing to take. IIS servers are in general more likely to be hacked than non-web servers. Remember when several exploits were discovered that allowed the attacker to often having a command console with SYSTEM priviledes on the server by simply typing the MSDOS command in a browser's URL? IIS has a very bad history of being vulnerable to several exploits...
When an IIS server is hacked, usually the attacker will have either SYSTEM rights on the server, or (hopefully) the lower rights of one of the IUSR accounts. These are all local accounts and thus have very limited access to the network. However if you have a SQL server running on the same server, that would make it much easier for the attacker to gain access to it than if it was hosted on a separate server.

Roberto

Best practice is to separate them if the IIS server is publicly available.

Now.... This is my opinion.... Even if you separate them do not put the SQL server on the trusted network. If your internal clients need access to it place it in the DMZ and set appropriate ACLs at the firewall to only allow connections from the private to the DMZ on the appropriate ports.

From a security POV I really dislike making databases available publicly. They are a significant additional layer of complexity that are very difficult to assure they are secure. The more confidential data you put in there the more you raise the stakes and put a big fat target on your organization. It's ok if you are running a BBS for Tortoise Husbandry but once you start putting personal data on it then you attract the seamier people's attention out there.

I have a sister organization that wants to put it's membership data on a public web site yet keep the server back in his facility to make it easier for their customers. I asked what data was held in that database. Name, address, credit card number.... was as far as the admin got.... "Sorry, but you aren't doing that inside my network" was my response. With all the injection techniques etc. neither he nor myself are qualified to sit here and say "Oh yeah, I can secure it, test it and monitor it effectively" and I really don't trust the sales guy from the company selling the product if he tells me "No problem - the code is bulletproof".

haha....you said 'sales guy' 'no problem' and 'bulletproof' in the same sentence.

Great response, Tiger, and astute obeservation, Juridian. Keep in mind that Microsoft Windows Small Business Server, is designed to have all those things in one box. That is not good practice and not the best way to protect your business, but that is what that particular version of the server does. I've seen them set up with IIS, ISA, SQL, and Exchange all running on the same system. Slowly, yes, but running. I haven't dug deeply into SB server to determine how that is done (I suspect virtual machines), but it is done and the course materials (Microsoft Official Curriculum) follow that path. Of course, this is for small office/home office networks where one server may be the norm and there might only be a handfull of client workstations. Putting a public face on that, though, is just plain scarey.

Your web application needs access to the database server anyway (well, some level fo access to some database). Even if you put it on a separate machine, if the web server is compromised, an attacker gains whatever level of access the web application had.

Therefore, unless you had some other, non-web related database on the same machine, I can't see how it improves security (much) to separate them.

So - yes, do put MSSQL server on the same box as IIS, but no, don't put your accounts database on the same machine when MSSQL is just used for some small membership system or something.

Putting the database on another machine will seriously reduce the performance of your web app.

Slarty

I have a couple sites that run the SBS....and if you throw good hardware at it...there are no performance issues.....

Really depends what you are doing with it.....one thing is the SQL and Exchange regularly fight for resources...

So if the site is heavy on exchange and SQL both ...I would consider breaking them apart...depending on user base

MLF

And, so, TechGrunt, you find that there are numeous opinions. I think the key, if you are looking at your own setup, is making sure you have adequate controls and security for the OS, applications and connections to make sure that everything stays _yours_ and the data is safe.

I like MLF's "throw good hardware at it" response. Just make sure others are out of the way.

;)

I'm familiar with SBS - a bit.... The wonderful thing about SBS is that MS has decided that if you are a "small business" you can't afford the hardware for the second server - so they bundle everything in one system, (SBS), and make it bloody impossible to join that server to an existing domain and almost bloody impossible to join another server the the spanking new SBS domain it insists on creating for itself..... Utterly godlike in it's narcissism... But it can be done.... ;)

As far as placing the SQL server on the same server as the IIS or not:-

If you run them both on the same machine then _either_ could be exploited and the _single_ server is compromised. If you separate them then an exploit on one box does not necessarily compromise the other box. If the IIS server is the only publicly available server and the SQL server properly sanitizes the input then the SQL server _should_ be very difficult to compromise even if the IIS server is. With them separated the attacker needs two exploits that work, with them together he can gain a foothold on the single box and even if it is a low level user context - but we have all heard of privilege escalation.

That's my position - two "major" systems on the same box complicate the box... The more complicated the box the more vulnerable it is..... Thus separation _without_ trust is the way to go....

Thanks for the responses everyone. Given me a bit to go on

Tek

I think what we are all getting at here...

It really depends on what hardware you are using, how many users and what processes will be running....

What kind of data is going to be made public....all the SQL data...or just some of it. If it is just some of it...consider having the main data on a seperate machine....and table import the data needed to be made public...replicate back and forth if needed.

I am running a SQL database...and importing and updating data has been so far...painless...all depends on how many records etc

TS has a great point about seperating them...makes it harder to compromise 2 systems...and hopefully easier to detect....make them jump through some hoops ;)

MLF

Quote:

---

and maybe easier to detect

---

Much..... with both servers in a DMZ alone with eachother:-

Ruleset start

Alert tcp IIS_SERVER any -> SQL_SERVER !1433 (msg: Someone is on my IIS Server, (TCP)"; classtype: bad-unknown;)
Alert udp IIS_SERVER any -> SQL_SERVER any (msg: Someone is on my IIS Server, (UDP)"; classtype: bad-unknown;)

include ms-sql.rules

Ruleset end

Very oversimplified - but you get the point.... ;)

Hey Hey,

Here's my line of thinking on this.

It would be nice if every major service you were running had it's own machine... That's everyone's dream... however it's not always reality..

I've got 2 servers... and let's just say I've got more than two uses for those servers..

Server 1 - 1 x 2.4Ghz Xeon Processor, 2GB RAM, SCSI Drives... It's running... AD, IIS, Exchange, SQL 2000.

Server 2 - 2 x 1Ghz P3, 648MB RAM, SCSI OS Drive, SATA Storage Drives.... File and Print Server... (Which also means running services for mac)

While the server is bogged down... it runs stable... The $1200 for a new server with the required specs just isn't feasible at this time (or so I'm told)...

I'm slowly learning that with smaller companies... it's not the mentality of security and stability... it's the mentality of "if it works.. it works... that's all that matters"..

Even if we were to get another server it'd still be IIS and SQL 2000 on the server... Mostly because I don't like my AD being the public machine... Either that or it'd be AD and SQL in the back with IIS and Exchange in the front...

Anyways... this sums up into... get as many individual servers as they'll allow you (or you can afford) and seperate your services... but in the end... as long as you're careful the software tends to play fairly well together and one server can multitask as needed.

Peace,
HT

EEK.... HT.... You are breaking the biggest rule.... IIS and AD on the same box... assuming that this is your domain's AD and it is publicly available.

Go find that crappy old workstation that will only just run Win2k server. Fire it up in a DMZ and have it run IIS. Have it receive SMTP and forward any mail to the Exchange Server on the private network. The only access to the Exchange Server from the public networm _might_ be SSL for OWA. Run your web site(s) out there too.

If you need the SQL server to server data to the IIS server bring it inside, (since it is also your AD), and only allow 1433 from IIS box to SQL box from the DMZ. That's a more secure stance than you have right now.

Two of my public machines are old PII/266 laptops - one of which has a broken screen so it has to be TS'ed to to administer it. They only serve secondary DNS and one serves as a backup SMTP server. They work fine.

If you allow any DNS resolution in to server one you need to be very careful since the server is an AD server you could leak all your private network structure out to the public network. You need to split that DNS if you do allow DNS queries in.

Hey Hey,

I'm breaking tons of rules... unforunately their last administrator had a Programming Degree... which is better than a 3 year diploma in system administration and networking.. especially when you're doing system administration... He spent 3 years here (lucked into the job initially) and has now moved on with a 4 year programming degree and 3 years of sysadmin under his belt.. and left me with this mess.

They don't believe in spending money on IT... (although I did get around 4000 when I started for upgrades... however there were more pressing matters than another server or security... at least in their mind)....

I've got an old machine here... It has to be fired up in the next bit just to see what's on it... and if I can do anything with it.... if I can get it working then I'll put it to work... However because of the software we run we're rather limited in what we can do...

We run Advertising Firm/Marketing Management software... we pay a monthly fee for it... It requires SQL and IIS on the same box.. (not sure why the same box... but hell I wasn't even allowed to install it.. had to give them remote access to do it)... It also has to be live on the internet for their billing server to run queries and access certain pages so they can charge us accordingly...

Also.... All I've got to work with as far as networking equipment goes is a 4-port linksys router (Firmware circa June 2001) and a couple of random SMC/DLink hubs and switches... nothing I can really use to manage anything...

My Actual goal is to take the one spare box I have.... and get two NICs for it... running it with a firewall distro in between the internet connection and the router... We will randomly lose our connection on weekends because our ISP does montly reboots and our linksys will only try to reconnect 3 times before giving up and saying failure... So I'd like to have linux establishing our connection and serving the router... or just the network (Eliminate the router completely)...

However... I'm applying several places over the course of this week.... I'm tired of the work I do for the limited pay I get... so we'll see if I actually get anything accomplished.

Peace,
HT

J00 FuX0r3d... ;)

Quote:

---

Originally posted here by Tiger Shark
J00 FuX0r3d... ;)

---

Already know that :)

Indeed, the decision on whether or not to put IIS and SQL on the same server comes down to a number of factors, the biggest probably being cost (dollars) and the criticality of the application/data.

No doubt industry best practices call for physical separation. At my company we have a firewall in between the web server and backend database and only allow ODBC through. If you assume that your IIS server will get compromised at some point (a safe assumption!), it then becomes a question of how important the data is sitting in the database. If you don't care much about the data, by all means put it on the same server. But if the data has value, you may consider firewalling the connectivity.

- Uncle D