Security Recommendations? Seperate IIS from Adaxes Service?

Question

We will be rolling out Adaxes to our customers for self-service. We have a DMZ and then our internal network. Pretty standard network topology. What is the recommended setup for this? Can we have a machine in the DMZ that is just the front IIS web server which ONLY speaks to an internal server which would be the Adaxes service on the internal network?

We are looking for our options for deploying this. What is recommended?

Answer 1

Hello,

Adaxes Web Interface cannot be installed in a DMZ. Adaxes can be installed only on a computer that is joined to an Active Directory domain.
I suggest you install Adaxes Web Interface on an internal server, and open up port 80 on this server.

Comments

Would this work? What port need to be opened up the internal service that has the Adaxes Service installed? Assume that the internal does not need any firewall rules.

I was looking at What ports does Adaxes use?, will it only use 389 TCP & 135 TCP? What about it using LDAPS 636 TCP?

Thanks, this could be a good FAQ article too ;)

---

Hello,

Yes, it will work. The Web Interface will use port 54782 to communicate with the Adaxes service. To obtain information from AD, the Web Interface will need the following ports: 389, 135, and 1028. Port 636 is used by the Adaxes service only.

---

Is that a security concern using LDAP 389 in a DMZ? All that traffic is unencrypted. Is there a way to use LDAPS 636 to obtain information from AD instead of LDAP 389? Thanks

---

Adaxes Web Interface uses port 389 to obtain non-security-sensitive data from AD (e.g. information on the Adaxes service connection point).
The Web Interface communicates with Active Directory via the Adaxes service using an encrypted TCP channel. All the Active Directory data is passed through this encrypted channel.

---

54782, 389, 135, and 1028 are those only opened up to the internal Adaxes server? Or is 54782 opened to the internal Adaxes service and 389, 135, and 1028 opened up to the Domain Controllers? What I really am asking, is what is the destination of these ports that are being opened up from the firewall?

I apologize for so many questions, but since this is in regards of HIPPA data detail is a must.

---

54782 should be opened to the Adaxes service,
389, 135, and 1028 should be opened up to the Domain Controllers.