Một cách chúng tôi làm điều đó bằng cách lắng nghe. Độc giả như mình đã nói với chúng tôi họ muốn một dịch vụ dựa trên Internet mà có thể mở rộng và nâng cao giá trị của các cuốn sách. Căn cứ vào đọc những phản hồi và kế hoạch chiến lược của chúng tôi, chúng tôi đã tạo ra một trang web | DMZ Concepts Layout and Conceptual Design Chapter 3 99 number of the areas that we must be aware of during our consideration of the design and its implementation. Application Servers in the DMZ Application server placement in the DMZ must be designed with tight control in mind. As in other screened subnet configurations the basic security of the operating system must first be assured on the local machine with all applicable patches and service packs applied and unused services disabled or removed if possible. We spend a great deal of time in this book covering the hardening of your systems Windows 2000 Sun Solaris and the like within the DMZ. Additionally functionality of the application servers located in the DMZ should be limited to specific tasks that do not involve critical corporate data or information. Therefore although it is acceptable to place a Web server in the DMZ with a supporting database server neither of those servers should contain confidential or critical corporate information because they are still located in an area in which they are considered untrusted. Critical or confidential information should not be accessible from or stored in the DMZ. For example as discussed in the following section it is not acceptable to store any type of internal network authentication information on machines in the DMZ. Likewise front-end servers or application proxy servers can be placed in the DMZ for other needs such as an e-mail server front end or a DNS forwarder. In these instances neither the e-mail front end nor the DNS server should store any information about the internal network or allow general communication to pass unchecked to or from the internal network. Traffic to these servers from the internal network should pass through a firewall restricting traffic to individual machines in both directions using specific port and address information. Domain Controllers in the DMZ Domain controllers for Windows networks or other directory services authentication
