General question on j2ee and dmz

I've been developing a j2ee project.  The final outcome is an ear file that is deployed by weblogic.  Today our network guys are saying that this is a security hole.  They are placing weblogic in the dmz so there could be potential database security issues with the cmp getting data from the db.  They are telling me that i have to break it up so that the html, jsp, images, etc can be in the dmz but the jar file can be behind the firewall.

I have a problem with this whole issue but the main one is that from weblogics site, they use an architecture that has weblogic begind the firewall using an ear file.
And when i propose this to them they cant seem to give me a straight answer.


Do these guys know something that IBM, Sun, BEA, Oralce, Sybase, etc doesnt regarding the use of ear files and security issues.

Thanks
borg48Asked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
 
yorenConnect With a Mentor Commented:
The Basic Architecture doesn't apply, because your network has a DMZ. The Basic Architecture is (in my opinion) for networks with only one firewall.

However, I see no reason to break up the presentation layer from your EJBs. I'd recommend putting the whole ear and Weblogic server in your DMZ.
0
 
yorenCommented:
Most experts (including BEA's site) recommend putting the web/application server in the DMZ; this provides some protection against security holes in the Weblogic or Java software. See http://e-docs.bea.com/wls/docs70/cluster/planning.html#1067007 .

For the database placement you have two options. The most secure option is to create a web-only database in the DMZ, so that you don't need a hole in your inner firewall for application <--> database traffic. The other option is to place the database behind the inner firewall and open a hole for database traffic.
0
 
borg48Author Commented:
So does that mean breaking up the ejb's from the presentation layer?
0
 
borg48Author Commented:
What about keeping the whole ear file (war and jar) behind the DMZ ( behind a firewall ) and just open up traffic for the port being used which is 80.  This is like
Figure 6-1 Recommended Basic Architecture from the link you gave me.
0
 
borg48Author Commented:
What kind of security issues are there when the ejb tries to access the database.  Of course we have to open up the port that the database is listening right?

Thanks for the infor you have given me
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.