Improving Web Application Security: Threats and - CGISecurity

482 Part IV: Securing Your Network, Host, and ApplicationFirewall ConsiderationsYour security infrastructure can include internal firewalls on either side of theapplication server. This section discusses the ports that you open on these firewalls tosupport the functionality of your application.Enterprise ServicesIf you use middle-tier Enterprise Services, configure an internal firewall thatseparates the Web server and application server to allow DCOM and RPC traffic.Additionally, if you use Enterprise Services, your applications often use distributedtransactions and the services of the Distributed Transaction Coordinator (DTC). Inthis event, open DTC ports on any firewall that separates the application server fromremote resource managers, such as the database server. Figure 17.3 shows a typicalEnterprise Services port configuration.Web Server(Client)135(RPC EndpointMapper)RPCDCOMPort range >1024ORStatic port135(RPC EndpointMapper)EnterpriseServicesSQL ServerPort 1433(default)DTCPort(s)RPCDTCTrafficTCPSQLTrafficSQLServerFigure 17.3Typical Enterprise Services firewall port configurationNote Figure 17.3 does not show the additional ports that are required for authenticationmechanisms between a client and an Enterprise Services application and possibly between theEnterprise Services application and the database server. Commonly, for networks that do notuse Active Directory, TCP port 139 is required for Windows authentication. For more informationon port requirements, see the TechNet articles “TCP and UDP Port Assignments,” athttp://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/tcpip/part4/tcpappc.asp,and “Security Considerations for Administrative Authority,” at http://www.microsoft.com/technet/security/bestprac/bpent/sec2/seconaa.asp.