0

I work for a small organization within the government. We maintain our own Windows Server 2003 web server on the the govt. DMZ. We have to migrate to Windows Server 2008 or 2012 by July. Additionally, I'm rebuilding the website with .Net which will now utilize an SQL Server database instead of MS Access.

I have read it's not the best idea to have both IIS and SQL Server on the same box, especially one exposed to the world. Due to budget and politics, we are looking at one server only. Our existing server can not be upgraded; it doesn't meet the minimum requirements for Windows Server 2008+.

I currently working on a configuration for a new server and I'm considering running SQL Server on a virtual machine, while IIS runs on the host itself. What are my security concerns with this setup? Is it possible for a hacker to steal my VM and gain complete access? None of the data will be classified, as it's all accessible via our public website.

EDIT - Adding Server Specifications

Dell PowerEdge T430 Tower (FT430)

  • 2 x Intel Xeon E5-2620 v3 2.5GHz, 15M cache
  • 8 x 8GB RDIMM, 2133MT/s, Dual Rank x8 Data Width
  • PERC H730 RAID Controller (will use RAID 5)
  • 4 x 600GB 15K SAS 2.5in Hot Plug HDDs
  • OnBoard Broadcom 5720 Dual Port 1Gb LOM
  • Dual, Hotplug,Redundant Power Supply (1+1),495W
Improve this question
10
  • 3
    This seems like a layer 8 problem. Ask for more budget so that you can work on a set up that makes sense. Commented Mar 20, 2015 at 15:10
  • 1
    Ha, layer 8. Classic. Commented Mar 20, 2015 at 15:19
  • if your server can't already meet the requirements for 2008+, you have a lot more to worry about. MSSQL is very RAM hungry. Putting it into a VM is not a good idea. In a pinch, you can have IIS/SQL on the same box as long as you firewall the ports. Commented Mar 20, 2015 at 15:21
  • 2
    Short answer: Get 1 box and use hyper-V. Install the IIS server and SQL server as separate instances. If you set up firewalls on both of the boxes (including rules between the two VMs) then you're as safe as can be. You can control the resources assigned to each VM if you need to give your database more kick. If you're running on access now then you'll be fine with 1 box. Commented Mar 20, 2015 at 17:55
  • 1
    Install both as VMs on one host or all of it on one server native. Make sure your firewall is setup correctly if you are worried about security. Commented Mar 20, 2015 at 18:25

3 Answers 3

Reset to default
3

Not really knowing what server you are actually looking at we can only guess.

Adding to what GregL and Jim B said.

My guess is you're migrating from Server 2003 Standard, IIS 6.5, Access 2007 using ASP classic code pages connecting via OLEDB static. You might be planning on importing your Access using Upsizing Wizard (which kind of works most of the time) or you might try the 32bit app Import/Export.

For your new setup I'm thinking, MS Server 2012 Standard that is licensed for 1 physical and 2 virtual installs. That would offer you the option of running SQL and IIS independently in different VM's. But, that might not be the best approach in your case.

DO NOT: run public applications from a hyper-V HOST OS. I would also suggest not to enable RDP on the HOST. Think of the host as the power cord to your server. If it breaks, you'll need to be onsite to fix it.

YOU CAN: install IIS in a Virtual Machine > Memory depends your code code, if you run ASP classic or .Net

YOU CAN: install MS SQL in a Virtual Machine > Size of your VM depends on your Edition of MS SQL. Express versions offer up to 10GB of total overhead with data (Compare Editions).

Plan your server as you see it 7 years from now. Example: Virtual Server Drive Size day one, 128Gb, year 5 1.5TB, planned 3TB.

IIS 7.5 and above does work very well in a Virtual Environment. Running MS SQL Express designed for your OS in your virtual environment is also good. The idea behind it all is to be able to run more from a single physical server than before. If it runs in a stand alone install it should be just find in a virtual install. Excluding Datacenter versions that profit from using all physically attached devices and memory. Having both IIS and SQL Express on the same VM reduces my admin time by not having to watch a second server. Unless you're planning on running a Datacenter version, then you want it on it's own physical machine.

Here are some numbers off of my Server 2008 R2 Standard. CPU 3.3Ghz, 8 core, 1 Physical 1 Virtual Windows servers, 2 Virtual Ubuntu Servers, 2 Win8 Virtual Desktops, 2 Win7 Virtual Desktops.

IIS = 3.4Gb (27 IIS www sites, 3 ASP Classic 24 .Net)

2008 SQL Express = 1.14Gb (28 dbs active)

OS 2008 R2 VM = < 2Gb

Total Memory 10Gb never has used it all.

Your 64Gb memory machine will be nice but take your real numbers and tune your system to match plus 20% or what the OS recommends.

Regarding the hackers, they do exist, but so do scripts. Plan your system recovery as if you're planning on being hacked every night. And practice your recovery process until it's perfect then when it's needed it will actually work.

Improve this answer
6
  • Great write-up and spot-on assessment. I'm handling data migration via custom VB.Net program. The new database (which will run on SQL Standard Edition) will be vastly different and more complex than the Access DB, hence my custom program which will import, clean, and split data to the new tables. As for the server I'm looking at, I'll list the full specs Monday when I get back to work. Maybe you can give me a few more pointers on hardware specs? Commented Mar 21, 2015 at 15:29
  • @merlot Thank you for the comment and the answered question. I look forward to seeing your hardware inventory. Add the Model Numbers! Most of all, enjoy the build and take your time making it perfect. Commented Mar 21, 2015 at 15:39
  • I've updated my original post with the server specs. Commented Mar 23, 2015 at 15:04
  • @merlot I read over the configuration options you are offered with the T430. I like the drive setup. You will like the power consumption and the drain on a good UPS will be low. The first question that comes to mind is about your Expected Hackers. Where's my drive configuration for my backups? :) My Hyper-V likes it's own OS Disk, Mirror or not but backup to another drive. My VM's really like their big RAID and 1.8TB is small enough to backup to a spindle 3TB green drive if you must. Other than that it's all Good. Commented Mar 23, 2015 at 22:13
  • For backup, I have a 6TB NetGear ReadyNAS I was going to connect via crossover to the 2nd NIC port and use it for backup for OS and Databases. The drive size of the server (and the NAS for the matter) are over-kill considering out current web server uses less than 200GB. However, more folks are embedding HD video in their PowerPoint Presentations (which is one the file types we host), so I expect an increase in usage over the next few years. Commented Mar 24, 2015 at 1:11
1

No, a hacker can't 'steal your VM and gain complete access'. They'd need to hack into the VM management interface and if they end up there, your government department has much bigger issues.

Running both IIS and SQL on the same server is technically fine, but whether or not it's a good idea really depends on whether or not your load profile allows it.

If it's a small site, you're all good. I've seen lots of these one-offs run perfectly fine. Just make sure you have enough resouces (CPU, RAM and disk I/O) to let IIS and SQL perform well and limiting SQL to only a subset of the CPU/RAM might not be amiss so that it doesn't hog it all. Cause it will if you let it.

If it's a really big/busy site then you'll want to re-consider. Seeing as you're currently using MS Access, I can't possibly imagine that this is the case.

In terms of security concerns, it really comes down to how you want to manage the various pieces. If you intend to connect to the SQL instance from your desktop, then you've got to have port 1433 exposed and that means others can get in that way too. Unless your firewalls are setup in such a way that such connections could be allowed only from the internal zones. If you're happy RDPing into the server and doing it all locally, you just need to expose the IIS ports (80 and/or 443), which is no less secure than what you likely have now.

After re-reading the question and the comments, I see that you want to have one physical server. It will run IIS as well as VM for SQL.

That makes no sense. Either treat the server as a straight hypervisor and run both tiers in individual VMs, or run them both natively on the hardware. Mixing things is only going to lead to tears.

Improve this answer
1
  • 1
    What GregL said. I've run IIS and SQL on the same server. It depends on your load. However, running a VM on top of Windows will add load, and SQL needs the memory the virtual OS would be using. Commented Mar 21, 2015 at 0:24
0

Its fine. The difference is that if you've compromised the web server, you've compromised the SQL server for free. Since its on the DMZ, make sure management ports are firewalled off, and that you configure memory limits on SQL server.

Improve this answer
3
  • I don't have access to the govt. firewall, so the Windows firewall on the server? Commented Mar 20, 2015 at 20:02
  • 1
    I'm not Jim B, but yes, firewall the server. I would use Windows firewall to block off all access to SQL remotely. IIS can see it; that's all you need. Commented Mar 21, 2015 at 0:23
  • 1
    Yup I couldn't say it better Commented Mar 21, 2015 at 0:25

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.