Improving Web Application Security: Threats and - CGISecurity

784 Improving Web Application Security: Threats and CountermeasuresRestricting Server-to-Server CommunicationYou can also use IPSec to provide server authentication. This is useful whenrestricting the range of computers that can connect to middle-tier application serversor database servers. IPSec provides three authentication options:●●●KerberosTo use Kerberos, the computers must:● Be part of the same domain and forest● Be within a specific source address range● Be within the same subnet● Use static IP addressesPre-shared secret keyTo use pre-shared secret-key-based authentication, the two computers must sharean encryption key.Certificate-based authenticationTo use certificate authentication, the two computers must trust a commoncertificate authority (CA), and the server that performs the authentication mustrequest and install a certificate from the CA.In this section, you set up IPSec authentication between two servers by using a presharedsecret key. To perform server-to-server authentication1. Start the Local Security Policy MMC snap-in.2. Right-click IPSec Security policies on the local machine, and then click Create IPSecurity Policy.3. Type “MyAuthPolicy” [SSJ2]for the name, and then click Next.4. Clear the Activate the default response rule check box.5. Click Next and then Finish.The MyAuthPolicy Properties dialog box is displayed so that you can edit thepolicy properties.6. Click Add, and then click Next three times.7. In the Authentication Method dialog box, select Use this string to protect the keyexchange (preshared key).8. Enter a long, random set of characters in the text box, and then click Next.You should copy the key to a floppy disk or CD. You need it to configure thecommunicating server.