Improving Web Application Security: Threats and - CGISecurity

Chapter 11: Building Secure Serviced Components 315DCOM uses RPC dynamic port allocation that by default randomly selects portnumbers above 1024. In addition, port 135 is used by the RPC endpoint mapper. Youcan restrict the ports required to support DCOM on the internal firewall in two ways:● Define port ranges.This allows you to control the ports dynamically allocated by RPC.●Use static endpoint mapping.Windows 2000 SP3 (or Quick Fix Engineering [QFE] 18.1 and greater) or WindowsServer 2003 allow you to configure Enterprise Services applications to use a staticendpoint. Static endpoint mapping means that you only need to open two ports inthe firewall. Specifically, you must open port 135 for RPC and a nominated portfor your Enterprise Services application.For more information about defining port ranges and static endpoint mapping, see“Firewall Considerations” in Chapter 17, “Securing Your Application Server.”Using Web ServicesIf opening ports on the internal firewall is not an option, then you can introduce aWeb services façade layer in front of the serviced components on the applicationserver. This means that you only need to open port 80 for HTTP traffic andspecifically for Simple Object Access Protocol (SOAP) messages to flow in bothdirections as shown in Figure 11.4.Web ServerApplication ServerWebApplicationSOAPPort80WebServicesFacadeEnterpriseServicesPerimeterFirewallInternalFirewallFigure 11.4Using a Web services façade layer to communicate with Enterprise Services using HTTPThis approach does not allow you to flow transaction context from client to server,although in many cases where your deployment architecture includes a middle-tierapplication server, it is appropriate to initiate transactions in the remote servicedcomponent on the application server.For information about physical deployment requirements for service agents andservice interfaces such as the Web services façade layer, see “Physical Deploymentand Operational Requirements” in the Reference section of the MSDN article,“Application Architecture for .NET: Designing Applications and Services.”