I have two Linux servers connected to each other via a cross-connect cable, forming a local network. One of the servers presents a DMZ for the other server (e.g. database server) that must be very secure.
I'm restricting this question to communication between the two servers for ports that only need to be available to these servers (and no one else). Thus, communication between the two servers can be established by:
(1) opening the required port(s) on both servers, and authenticating according to the applications' rules.
(2) disabling IP Tables associated with the NIC cards the cross-connect cable is attached to (on both servers).
Which method is more secure?
In the first case, the needed ports are open to the external world, but protected by user name and password.
In the second case, none of the needed ports are open to the outside world, but since the IP Tables are disabled for the NIC cards associated with the cross-connect cables, essentially all of the ports may be considered to be "open" between the two servers (and so if the server creating the DMZ is compromized, the hacker on the DMZ server could view all ports open using the cross-connect cable).
Any conventional wisdom how to make the communication secure between two servers for ports only these servers need access to?
Best Answer
Well I'm leaning towards one: Make sure that only connections from that can be made, originate from the server. So you need to add a source option to the iptables rules. Then you still have a defense in place with authentication. The problem is that if there's an application running on the server that can login to the database, there might be a chance that a malicious user finds it out IF he gets access to your server.
What I don't understand is why you would disable iptables on a NIC, it's not because you enable iptables on a NIC that all of a sudden it's accessible by the WAN. On the contrary, you can restrict access with it.