|
Posted by Roger Abell [MVP] on September 8, 2006, 9:56 am
Please log in for more thread options > Thanks for your reply Steven
>
> The computer is indeed a standalone machine and I am not able to grant
> domain users any access to the server. I just wanted to get some feedback
> if it should be possible to grant them access or not.
>
> But I will stick to having everyone using FTP to access the data on the
> server.
>
That sounds like an appropriate plan given that you have elected to have
a non-anonymous access FTP service. One way some do all internal domain
accounts is to have the DMZ have its own domain, that trusts the internal.
A trusting domain can then use the accounts of the trusted for such as
access
to the FTP server. This way, if the DMZ machines get compromised then the
intruders have access to information about the internal domain, perhaps
ability
to trap account credential info, but they have limited immediate access to
the
internals domain as the machines then own are not in that domain.
The best way to have a barrier however is to have no inherent relationship
between the internal and what is in the DMZ. That does however have its
const (new account management, operational access for backup, monitoring,
etc..)
>> You could only be able to add domain users if the computer was a member
>> of the domain or a trusted domain. I would double check that the computer
>> is indeed a stand alone computer if you can add domain users/groups. A
>> stand alone computer can only grant access to local users/groups that
>> could have the same credentials as domain users and allow access to share
>> assuming ipsec or such is not denying access.
>>
>> Steve
>>
>>
>>> Hi all
>>>
>>> I am in the process of installing an FTP server in our organization
>>> (Gene6 FTP server running on Windows Server 2003). The server is located
>>> in DMZ. I would like internal domain users to be able to access it
>>> through windows file sharing and external users to use FTP client.
>>> So I thought for security reasons to not add this server to our internal
>>> domain.
>>>
>>> My problem then is that I am to able to add users from our domain to a
>>> security group on the FTP server.
>>>
>>> Is this not possible by design, or am I doing something wrong here?
>>>
>>> Appreciate some feedback.
>>>
>>> Thanks.
>>>
>>> /Thomas
>>>
>>
>>
>
>
| 
XML Sitemap