Improving Web Application Security: Threats and - CGISecurity

484 Part IV: Securing Your Network, Host, and ApplicationIf your deployment architecture includes a remote application tier, transactions arenormally initiated there within the Enterprise Services application and arepropagated to the database server. In the absence of an application server, theEnterprise Services application on the Web server initiates the transaction andpropagates it to the SQL Server resource manager.For information about configuring firewalls to support DTC traffic, see:●●●“DTC Security Considerations” in the COM+ platform SDK athttp://msdn.microsoft.com/library/default.asp?url=/library/en-us/cossdk/htm/pgdtc_admin_9dkj.aspMicrosoft Knowledge Base article 250367, “INFO: Configuring MicrosoftDistributed Transaction Coordinator (DTC) to Work Through a Firewall.”Microsoft Knowledge Base article 306843, “How To: Troubleshoot MS DTCFirewall Issues.”.NET RemotingIf you use the HTTP channel and host your remote components in ASP.NET, onlyopen port 80 on the internal firewall to allow HTTP traffic. If your application alsouses SSL, open port 443.If you use the TCP channel and host in a Windows service, open the specific TCP portor ports that your Remoting application has been configured to use. The applicationmight need an additional port to support callbacks.Figure 17.4 shows a typical .NET Remoting firewall port configuration. Note that theport numbers shown for the TCP channel scenario (5555 and 5557) are illustrations.The actual port numbers are specified in web.config configuration files on the clientand server machines. For more information, see Chapter 13, “Building SecureRemoted Components.”