Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

General question on j2ee and dmz

Posted on 2002-06-06
5
Medium Priority
?
412 Views
Last Modified: 2013-11-24
I've been developing a j2ee project.  The final outcome is an ear file that is deployed by weblogic.  Today our network guys are saying that this is a security hole.  They are placing weblogic in the dmz so there could be potential database security issues with the cmp getting data from the db.  They are telling me that i have to break it up so that the html, jsp, images, etc can be in the dmz but the jar file can be behind the firewall.

I have a problem with this whole issue but the main one is that from weblogics site, they use an architecture that has weblogic begind the firewall using an ear file.
And when i propose this to them they cant seem to give me a straight answer.


Do these guys know something that IBM, Sun, BEA, Oralce, Sybase, etc doesnt regarding the use of ear files and security issues.

Thanks
0
Comment
Question by:borg48
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
5 Comments
 
LVL 7

Expert Comment

by:yoren
ID: 7061041
Most experts (including BEA's site) recommend putting the web/application server in the DMZ; this provides some protection against security holes in the Weblogic or Java software. See http://e-docs.bea.com/wls/docs70/cluster/planning.html#1067007 .

For the database placement you have two options. The most secure option is to create a web-only database in the DMZ, so that you don't need a hole in your inner firewall for application <--> database traffic. The other option is to place the database behind the inner firewall and open a hole for database traffic.
0
 

Author Comment

by:borg48
ID: 7061194
So does that mean breaking up the ejb's from the presentation layer?
0
 

Author Comment

by:borg48
ID: 7061198
What about keeping the whole ear file (war and jar) behind the DMZ ( behind a firewall ) and just open up traffic for the port being used which is 80.  This is like
Figure 6-1 Recommended Basic Architecture from the link you gave me.
0
 
LVL 7

Accepted Solution

by:
yoren earned 240 total points
ID: 7061245
The Basic Architecture doesn't apply, because your network has a DMZ. The Basic Architecture is (in my opinion) for networks with only one firewall.

However, I see no reason to break up the presentation layer from your EJBs. I'd recommend putting the whole ear and Weblogic server in your DMZ.
0
 

Author Comment

by:borg48
ID: 7061277
What kind of security issues are there when the ejb tries to access the database.  Of course we have to open up the port that the database is listening right?

Thanks for the infor you have given me
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Introduction This article is the first of three articles that explain why and how the Experts Exchange QA Team does test automation for our web site. This article explains our test automation goals. Then rationale is given for the tools we use to a…
In this post we will learn different types of Android Layout and some basics of an Android App.
Viewers will learn about the different types of variables in Java and how to declare them. Decide the type of variable desired: Put the keyword corresponding to the type of variable in front of the variable name: Use the equal sign to assign a v…
This tutorial covers a step-by-step guide to install VisualVM launcher in eclipse.
Suggested Courses

721 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question