Solved

What is the best way to lock-down Windows 2008 R2 Active Directory domains with two-way transitive trusts?

Posted on 2014-03-29
9
921 Views
Last Modified: 2014-04-09
Here's the scenario I am working with and would welcome thoughts from the experts here on best way to address it:

Requirement:
Secure environment from external and internal threats by reducing attack surface.

Environment:
Single forest with two domains: production and DMZ. Production and DMZ both have a two-way trust established with selective authentication (read and authenticate). An application layer next-gen firewall (Palo Alto) is sitting between the two environments.

DMZ domain has one-way trust enabled with selective authentication and is the trusting domain for the external third-party domain. this is being used to allow access to external parties to view relevant information available in the dmz domain.


Operational requirements:
AD LDS is utilized to synchronize an in-house developed application data across Production and DMZ domain and as a result a number of ports are open between the two domains. Separate LDS instances cannot be maintained for the two environments.

Additional info:
 - The environment is well patched but occasionally the patch cycle is missed leaving the environment exposed.

- Link between dmz and external domain is via a private leased line (HSDL). Internet connectivity is available within the dmz domain but not in the production domain.


 Question: How do we lockdown the environment without impacting operations?
0
Comment
Question by:artsandtech
  • 3
  • 3
  • 2
  • +1
9 Comments
 
LVL 7

Expert Comment

by:Delete
ID: 39964553
0
 
LVL 35

Assisted Solution

by:Mahesh
Mahesh earned 250 total points
ID: 39964710
From management point you have to manage two AD domains

From security stand point what you have done is perfect according to my opinion if below is true.
I hope there is no trust exists between production domain and DMZ domain, or else it will like partially defeat purpose of having separate DMZ domain, because in that case it will not remain totally isolated environment
AD LDS is different from active directory and you can have AD LDS ports opened between production instance and DMZ instance, anyhow you cannot skip that requirement since same application \ database is used in production and DMZ I guess.

Now for 3rd party external domain, instead of building one way trust with selective authentication, you might consider implementing ADFS server (Federated trust) which will provide required resource access without need of domain trust
You can search ADFS infrastructure on internet
Note that both source and destination domain needs to deploy ADFS server infrastructure and you have to have certificate based protocol (SAML 2.0) supported by application for authentication (Application must be ADFS aware - can work with SAML 2.0 protocol)

Because according to me domain trust is hole in security and best suited within corporate network \ LAN only.

Mahesh.
0
 
LVL 24

Expert Comment

by:Mohammed Khawaja
ID: 39964982
aDFS is the best solution and note that this is how cloud apps are deployed on hosted services.  This would be no different.
0
 

Author Comment

by:artsandtech
ID: 39974335
thanks all but considering I am opening ports for LDS traffic between the two domains,  is there something else that can be done to further reduce this exposure apart from the obvious firewall filters ?
0
 
LVL 35

Expert Comment

by:Mahesh
ID: 39974353
According to my knowledge firewall filters are sufficient and you can't do more than this

You may follow MS best practices to harden ADLDS servers but same time you need to ensure that your application will work correctly

Hardening involves
disabling non essential services
Renaming local administrator account
Disabling guest account
Installing appropriate MS security updates and service packs
Installing appropriate Anti virus softwares with proper exceptions
You will get standard server lockdown documentation \ links on internet

Mahesh.
0
 
LVL 7

Expert Comment

by:Delete
ID: 39976366
You can implement IPsec and encrypt the traffic between your domains.  That way the only traffic going through the firewall is encrypted traffic and you only need to allow the IPsec ports.
0
 

Author Comment

by:artsandtech
ID: 39990226
Ipsec is an interesting idea,  but what about overheads? Will it impact my AC-LDS traffic? How do Ipsec connections get setup for LDS replication? All to all across domains?
0
 
LVL 7

Accepted Solution

by:
Delete earned 250 total points
ID: 39990320
The overhead would be placed on the terminating ends.  So if you are going from server to server then the over head would be on those nodes.  This is simply because they are doing the encryption/decryption.  It will not impact your LDS traffic, when you setup IPsec you choose the source and destination (can be single machine or full subnet) along with what ports and protocols are allowed between those hosts.  You would need to setup an IPsec rule on every machine that needs to talk to the DMZ and vice versa, but this can be done through GPO.

A few things to keep in mind with IPsec.
1. Depending on your environment it can become very complex so extensive planning needs to occur.

2. The most secure way to implement IPsec is to have the tunnel terminate at your boundary device so that you don't have an encrypted tunnel going through your firewall (you can only do this if your firewall is capable of this, but this will increase the overhead considerably).  If you do an encrypted tunnel through your firewall then you can't inspect the traffic and you would need at the very least HIPS installed on each endpoint.  

3.  If you setup your IPsec rules incorrectly, you can accidentally isolate your machines so again plan thoroughly and carefully.

Refer to these two articles for more information:
http://technet.microsoft.com/en-us/library/cc700826.aspx
http://technet.microsoft.com/en-us/library/cc700829.aspx
0
 

Author Closing Comment

by:artsandtech
ID: 39990504
thanks both Mahesh and Justin. I have to do some more research and testing before taking any actions.
0

Join & Write a Comment

New Windows 7 Installations take days for Windows-Updates to show up and install. This can easily be fixed. I have finally decided to write an article because this seems to get asked several times a day lately. This Article and the Links apply to…
Is your Office 365 signature not working the way you want it to? Are signature updates taking up too much of your time? Let's run through the most common problems that an IT administrator can encounter when dealing with Office 365 email signatures.
This tutorial will show how to push an installation of Backup Exec to an additional server in both 2012 and 2014 versions of the software. Click on the Backup Exec button in the upper left corner. From here, select Installation and Licensing, then I…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

23 Experts available now in Live!

Get 1:1 Help Now