Solved

Updating Antivirus and Windows on DMZ Servers

Posted on 2008-06-17
4
387 Views
Last Modified: 2013-11-22
I curently have 3 servers that reside in the DMZ, an app. server, mail server, and web server. I use WSUS and CA Antivirus Console to manage updates to everything inside our secure network. I am looking for the best way to keep these servers up-to-date with antivirus and windows updates. I cannot use the same method used with the devices on the internal network because the DMZ servers are in a workgroup in Active Directory. Currently, the firewall is configured to block port 80 for added security, so these machines cannot get their own updates. I felt it was more secure to keep these machines from initiating any connections through port 80.
Is there any other way I can push updates to these servers from inside the secure network allowing them to be managed the same way the rest of our intranet is managed? I am of the opinion that opening port 80 is a last resort and there must be another means by which I can keep these servers up-to-date internally.
0
Comment
Question by:cford1973
  • 2
  • 2
4 Comments
 
LVL 51

Accepted Solution

by:
Netman66 earned 500 total points
ID: 21818559
At some point, you are going to need port 80 open to get the updates from the Internet.  Unless you want to manually download them from the internal network then copy them to the DMZ.

You could setup WSUS in the DMZ and manually sync it on a fixed schedule.  During that time, you could open port 80 then close it again.  Honestly, creating an access rule for port 80 and 443 from the WSUS server to the 3 Microsoft sites should be fairly simple.  This would only let that one machine out and only to those sites.

Once this is configured you could let it manage itself.  You would need a registry mod to point all the DMZ equipment to the WSUS server, but that's simple enough.

0
 

Author Comment

by:cford1973
ID: 21821728
Netman66,

Other than setting the WSUS server up in the DMZ, is there a way to point those DMZ servers back to our secure network to get antivirus and windows updates? However, at this point, I am unsure of what ports would be used and subsequently, what firewall rules would need to be changed to make that work.

I can re-open port 80 on the firewall, and allow it to obtain Windows updates from the Internet; however, I was hoping to use WSUS to maintain consistency and a standardized audit trail in my network. I recently found out that CA Antiviurs does not use Port 80 to retrieve updates from the Internet, so I am not as concerned about those updates.
0
 
LVL 51

Expert Comment

by:Netman66
ID: 21822840
Not really, unless they are domain members.  Downlevel WSUS servers need to be part of the domain also - and that's not a good thing in the DMZ.

Creating rules from the WSUS server to Microsoft wouldn't be difficult.

I understand the need to stay consistent with the internal LAN - a HIPPA thing (my guess), but if you document the internal update approvals then following that script for the DMZ server shouldn't be difficult.  It's just another process.

I'm finding out for sure whether it's possible to chain a non-domain WSUS server to a domain WSUS server.  I need to know absolutely.
0
 

Author Closing Comment

by:cford1973
ID: 31468032
Thanks for your response. I appreciate it. I have since opened Port 80; however, it is only to initiate an outbound connection, not to accept. Other than the options you mentioned, the only other solution I could come up with was a redistribution sever, and that was not a viable alternative for me.
Thanks again.
0

Featured Post

Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

Join & Write a Comment

Article by: btan
Provide an easy one stop to quickly get the relevant information on common asked question on Ransomware in Expert Exchange.
Nothing in an HTTP request can be trusted, including HTTP headers and form data.  A form token is a tool that can be used to guard against request forgeries (CSRF).  This article shows an improved approach to form tokens, making it more difficult to…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now