Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

General question on j2ee and dmz

Posted on 2002-06-06
5
Medium Priority
?
417 Views
Last Modified: 2013-11-24
I've been developing a j2ee project.  The final outcome is an ear file that is deployed by weblogic.  Today our network guys are saying that this is a security hole.  They are placing weblogic in the dmz so there could be potential database security issues with the cmp getting data from the db.  They are telling me that i have to break it up so that the html, jsp, images, etc can be in the dmz but the jar file can be behind the firewall.

I have a problem with this whole issue but the main one is that from weblogics site, they use an architecture that has weblogic begind the firewall using an ear file.
And when i propose this to them they cant seem to give me a straight answer.


Do these guys know something that IBM, Sun, BEA, Oralce, Sybase, etc doesnt regarding the use of ear files and security issues.

Thanks
0
Comment
Question by:borg48
  • 3
  • 2
5 Comments
 
LVL 7

Expert Comment

by:yoren
ID: 7061041
Most experts (including BEA's site) recommend putting the web/application server in the DMZ; this provides some protection against security holes in the Weblogic or Java software. See http://e-docs.bea.com/wls/docs70/cluster/planning.html#1067007 .

For the database placement you have two options. The most secure option is to create a web-only database in the DMZ, so that you don't need a hole in your inner firewall for application <--> database traffic. The other option is to place the database behind the inner firewall and open a hole for database traffic.
0
 

Author Comment

by:borg48
ID: 7061194
So does that mean breaking up the ejb's from the presentation layer?
0
 

Author Comment

by:borg48
ID: 7061198
What about keeping the whole ear file (war and jar) behind the DMZ ( behind a firewall ) and just open up traffic for the port being used which is 80.  This is like
Figure 6-1 Recommended Basic Architecture from the link you gave me.
0
 
LVL 7

Accepted Solution

by:
yoren earned 240 total points
ID: 7061245
The Basic Architecture doesn't apply, because your network has a DMZ. The Basic Architecture is (in my opinion) for networks with only one firewall.

However, I see no reason to break up the presentation layer from your EJBs. I'd recommend putting the whole ear and Weblogic server in your DMZ.
0
 

Author Comment

by:borg48
ID: 7061277
What kind of security issues are there when the ejb tries to access the database.  Of course we have to open up the port that the database is listening right?

Thanks for the infor you have given me
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Go is an acronym of golang, is a programming language developed Google in 2007. Go is a new language that is mostly in the C family, with significant input from Pascal/Modula/Oberon family. Hence Go arisen as low-level language with fast compilation…
Basic understanding on "OO- Object Orientation" is needed for designing a logical solution to solve a problem. Basic OOAD is a prerequisite for a coder to ensure that they follow the basic design of OO. This would help developers to understand the b…
Viewers learn about the scanner class in this video and are introduced to receiving user input for their programs. Additionally, objects, conditional statements, and loops are used to help reinforce the concepts. Introduce Scanner class: Importing…
This tutorial covers a step-by-step guide to install VisualVM launcher in eclipse.
Suggested Courses

879 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question