Visit Our UNIX and Linux User Community


Setting up a DMZ webserver using Zones


 
Thread Tools Search this Thread
Operating Systems Solaris Setting up a DMZ webserver using Zones
# 1  
Old 09-15-2009
Bug Setting up a DMZ webserver using Zones

I've been looking at various articles about Zones/Containers, from SUN's website, and through numerous Google searches, and although there's a lot of info out there, I've not got a definitive answer for what I'd like to do.....so here we go.....

I'm installing a webserver, which is sitting on a DMZ port, so can be accessed from anywhere on the 'net. I've configured all the filesystems for various user groups, and now have a nicely patched Solaris 10 5/09 system Smilie

What I'd like to do is to drop a couple (or more) of the filesystems into their own non-global zone each, where they'll be running an instance of the web server, and serving a number of users who will be maintaining their own websites within the zone.

I'd ideally like the overal URL to stay the same, with only a port number change to distinguish the website groups from each other, for example:

http://xyz.com:80 (Group 1's sites, zone 1, filesystem 1)
http://xyz.com:81 (Group 2's sites, zone 2, filesystem 2)
http://xyz.com:82 (Group 3's sites, zone 3, filesystem 3)

The global zone will host the main web server , with each zone's web process just running enough to operate its own server.

Users will login to their own zone, and will not be able to login elsewhere (I know this can be done by maintaining /etc/passwd and /etc/shadow files per zone, so a user isn't recognised in the other zones).

My questions are:

1) - Is it feasible / possible to run the above setup, with keeping the URL the same across each zone, and just changing the port each time?

2) - When a user logs in, will they have to login to the global zone, and then use zlogin to connect to their specific non-global zone?

3) - (Similar to (2)) - Can users login directly to their zone from a remote system, or do they have to come in via the global zone?

4) - Does each zone have to have its own IP address? If so, is this internal to the server, or is it external?

At the moment, the global zone has been allocated an IP address for the DMZ. If each zone needs its own unique external address, this could be a problem (limited availability on our network) - better solution would be some form of internal NAT on the server to forward login requests to the relevant zone, if possible???

Quite a lengthy "query", but I've not yet found anything specific to the above setup. I did find something on setting up a similar system using 2 NICs, but I only have the 1.

Thanks in advance....

Last edited by in2deep; 09-15-2009 at 11:21 AM..
# 2  
Old 09-15-2009
Quote:
Originally Posted by in2deep
1) - Is it feasible / possible to run the above setup, with keeping the URL the same across each zone, and just changing the port each time?
Not directly as zones have different IP addresses.
Quote:
2) - When a user logs in, will they have to login to the global zone, and then use zlogin to connect to their specific non-global zone?
This isn't required and actually a bad practice.
Quote:
3) - (Similar to (2)) - Can users login directly to their zone from a remote system
Yes, assuming a service is available for them to log in, likely ssh.
Quote:
, or do they have to come in via the global zone?
No.
Quote:
4) - Does each zone have to have its own IP address?
A zone doesn't need to have an IP address but assuming you want the zone to be reachable from the network, it will need one or more addresses. Zones IP addresses must be different in the shared IP model. With exclusive IP, you might have the same IP address on more than one zone but that would probably be useless.
Quote:
If so, is this internal to the server, or is it external?
Both.
Quote:
At the moment, the global zone has been allocated an IP address for the DMZ. If each zone needs its own unique external address, this could be a problem (limited availability on our network) - better solution would be some form of internal NAT on the server to forward login requests to the relevant zone, if possible???
It should be. Solaris bundles ipf which supports NAT.
# 3  
Old 09-15-2009
Hmm, thanks for that. I'll digest it and see what I can come up with.

In reality I've quite a short timespan to get the server up and running, so it may be a case of configuring this server as a single global zone, adding some security, and getting it live. I can then play with zones on a spare box when time permits....
# 4  
Old 09-15-2009
You can still put all three instances in a non global zone. That would be a first step in virtualizing them.

Previous Thread | Next Thread
Test Your Knowledge in Computers #599
Difficulty: Medium
For modern C programming, defining functions is a two step process. First, you declare a function and its signature using a prototype. Then you define the function by providing a function body that defines what the function does.
True or False?

8 More Discussions You Might Find Interesting

1. UNIX for Beginners Questions & Answers

Sendmail - issue within DMZ for some servers but not all

Hi All, I have a strange issue and I am not sure where the problem lies. I have about six Ubuntu servers on our DMZ two of which were built on 18.04 from scratch the others were upgraded to 18.04 from 16.04. The servers built from scratch can send emails from the server via sendmail fine, so... (4 Replies)
Discussion started by: dakelly
4 Replies

2. UNIX and Linux Applications

One DMZ server reverse proxy for 2 websites

Hi All, Hope this is the correct thread to ask this, if not, can an admin please move it to the correct thread. Got a wee problem I hope someone can point me in the right direction. I have Network A with two servers hosting separate webpages (I will call these WP1 & WP2). A DMZ server... (6 Replies)
Discussion started by: dakelly
6 Replies

3. Shell Programming and Scripting

Create new users in DMZ box using script

I remote to many DMZ boxes every day to run batch file that allows me to create users. I create users in 17 DMZ boxes every day which takes a lot of my time. Is there any script that would do this job from my local computer? Thank you for your help! (3 Replies)
Discussion started by: idiazza
3 Replies

4. Cybersecurity

DMZ systems having internal IP, ok or not?

Hi, I am new here. Nice to meet you guys :) Here is my first question: We are using Fortigate 3800 as firewalls. The DMZ contains external DNS, web and proxy servers. Systems in DMZ use subnet 192.168.1.0, and the internal systems use subnet 10.1.1.0. My questions: Can we assign two... (3 Replies)
Discussion started by: aixlover
3 Replies

5. Shell Programming and Scripting

SFTP and DMZ boxes

Hi I would like write a script that will do sftp frm a box that resides inside the FW to a box that resides in DMZ.Any ideas guys.I tried generating rsa keys for a particular user, however just want to know is there any other solution or not. Your help is much appreciated. Thanks CK (2 Replies)
Discussion started by: coolkid
2 Replies

6. UNIX for Advanced & Expert Users

How do you manage your DMZ server accounts?

I'd just like to know what you use for user account management on your DMZ servers? Do you use the same authentication realm as internally? Do you use a different authentication realm, perhaps only for the DMZ? Do you use local accounts? (2 Replies)
Discussion started by: humbletech99
2 Replies

7. Linux

routing rules for dmz in debian router.

Hi to all. There are eth0(wan) eth1(lan) and eth3(dmz) in my debian router. In dmz is planing dns, ad, dhcp, smtp/pop/imap, https(web-based imap client). I don't configured rules on "iptables" and "route" loads for right relation lan clients with dmz services. Please explain me example... (0 Replies)
Discussion started by: sotich82
0 Replies

8. OS X (Apple)

Webserver Setup, need help!

Hey guys, does anyone know how I edit, configure the server settings using the terminal? MySQL and PHP was once working. But after frying the Xserve G5 i'm in the middle of rebuilding everything, I believe i need to re-configure the root document directory... but have forgotten how to edit... (1 Reply)
Discussion started by: hype.it
1 Replies

Featured Tech Videos