Bryan Ponnwitz wrote:
If you're worried about connection security, just use a VPN. Or better
yet, if the servers are both Win2K or better, use IPSec. IPSec is
Microsoft's recommended solution for extending domain communications to
another LAN across the Internet. I've read the KB article on it, but
don't have time to look for it right now.
IPSec/VPN mitigates some of the security issues pertaining to this
scenario, but it doesn't solve all of the issues, and it raises some of
its own.
The OP mentioned performance issues - VPNs certainly don't resolve this
issue, and would almost certainly make it worse, especially on a
bad/latent connection. Depending upon who the users of this
infrastructure are and how it's implemented, there are the obvious VPN
NAT/reliability concerns too.
A badly implemented VPN, or one implemented with equipment not capable
of packet filtering on VPN traffic (as is common in environments in
which people consider such nasty things as opening SMB traffic up to the
internet) would allow clients - albeit authenticated clients - access to
the entire internal network. Again, depending upon the identity of the
users of this infrastructure are, this might be highly undesirable.
A VPN or IPSec solution is also going to be harder to support, and
potentially make you very unpopular with whoever supports third party
clients when users don't have the rights necessary to configure a VPN,
install certificates, or setup IPSec (SMB/HTTP/FTP all work as a limited
user).
They're also very likely to be affected by outbound firewalling on third
party LANs, too...
In short: I'm not saying that VPNs can't help, you just need to use them
carefully; they're not a panacea, and they're far from ideal for a range
of scenarios!
- James
--
James (njan) Eaton-Lee | UIN: 10807960 | http://www.jeremiad.org
"The universe is run by the complex interweaving of three
elements: Energy, matter, and enlightened self-interest." - G'Kar
https://www.bsrf.org.uk | ca: https://www.cacert.org/index.php?id=3
--
smime.p7s
Description: S/MIME Cryptographic Signature
