Re: Bastion Host Vs. DMZ

You have to decide what level of security you would like to achieve. The 
cumulation of complex services on one host could be crucial for security 
level. Scenarios you've mentioned are two extremes.

    Bastion Host - will cumulate all services on one host whose security 
is crucial for internal network confidence. It could be usable for private 
or SMB internet connections where are very small values stored/protected 
by FW.
    DMZ Scenario - that you are talking about is much more secure, only 
problem that I can see there is the potentialy dangerous server in the 
middle of all comunication passing the firewall.

K.

Richard Verwayen <holle@ackw.de> wrote on 19.01.2005 00:32:08:

> Am Dienstag, den 18.01.2005, 14:28 -0300 schrieb Pablo Gietz:
> > Hi list
> >
> > Do you know when is more  convenient to use a Bastion Host for
> > (proxy,dns, etc)  or placing this machine inside a DMZ betwen 2
> > firewalls? 
> You may give the answer yourself!
>
> It is not a matter of convinience...
>
> You have to hack two machines to get into the secured network in the
> DMZ-scenario. (You used different passwords and software on these two
> firewalls didn't you?)
>
> Richard