Improving Web Application Security: Threats and - CGISecurity

Chapter 17: Securing Your Application Server 485Web Server(Client)80HTTPChannelASP.NETHostApplication ServerWeb Server(Client)Clientlistens on55575555(InboundOnly)5557(OutboundOnly)TCPChannelCallbacksServerlistens on5555WindowsServiceHostApplication ServerFigure 17.4Typical Remoting firewall port configuration for HTTP and TCP channel scenariosWeb ServicesWeb services communicate using SOAP over HTTP; therefore, only open port 80 onthe internal firewall.SQL ServerIf a firewall separates the application server from the database server, thenconnecting to SQL Server through a firewall requires that you configure the clientusing the SQL Server Client Network Utility and configure the database server usingthe Server Network Utility. By default, SQL Server listens on TCP port 1433, althoughthis can be changed. The chosen port must be open at the firewall.Depending on the chosen SQL Server authentication mode and use of distributedtransactions by your application, you might also need to open several additionalports at the firewall:● If your application uses Windows authentication to connect to SQL Server, openthe necessary ports that support the Kerberos protocol or NTLM authentication.● If your application uses distributed transactions, for example automated COM+transactions, configure your firewall to allow DTC traffic to flow between separateDTC instances, and between the DTC and resource managers, such as SQL Server.