MACROMEDIA BREEZE-SECURITY Manual page 8

Single Server Configuration
The easiest solution for a dedicated, single-server Breeze system is to block all ports on the Breeze
box except 80, 1935 (and 443 for SSL-enabled servers). If the Windows server is carefully
updated by your IT department with the latest Microsoft security patches, a software firewall can
easily be configured to enable application security. An external hardware firewall appliance can
provide an extra layer of protection and also provides additional protection against operating
system flaws.
Example: Securing a Single Server Configuration
Assume that you are setting up Breeze Live and Breeze Presentation on a single server. In addition,
the database is also to be installed on this server. You want users to be able to access Breeze on
the Internet.
Securing Breeze on a single server consists of the following steps:
Install a firewall
1
your Breeze server is open to an attack by hackers. By using a firewall, you can block access to
your servers and control what communications occur between the Internet and your servers.
Configure your firewall
2
as follows:
Inbound ports (from the internet): 80, 443, 1935
Outbound ports (to the mail server): 25
Since the database is located on the same server as Breeze, you do not need to open up port
1433 on the firewall.
Install Breeze
3
Verify that Breeze is working
4
working properly both from the Internet and from your local network. See the Breeze
Installation Guide for more information.
Test your firewall
5
verify that your firewall is working correctly. Test the firewall by attempting to use the
blocked ports.
Multi-server Solutions
Multi-server solutions are inherently more complex and will vary from customer to customer. It is
very important that the customer understand how to secure their multi-server installation. The
following are suggestions for securing multi-server solutions.
•
Private Networks
create an extra sub-network for the Breeze system. The network is bridged to the customer's
network by a firewall device which allows only traffic to the web servers. This offers a high level
of security but can be expensive.
•
Local Software Firewalls
network with other customer servers, a software firewall may be appropriate on each individual
server. The simplest route is to allow free communication among the Breeze servers but allow
outside access only to the web servers.
•
VPN Systems
different physical locations, customers may want to consider an encrypted channel to the
remote systems. This setup will probably be uncommon, but many software and hardware
vendors offer VPN technology to secure the communications to remote Breeze servers. Breeze
relies on this external security if data traffic must be encrypted.
8 Security and Macromedia Breeze
Since you are allowing users to access Breeze on the Internet, this means that
After installing your firewall, you want to configure your firewall
For information on installing Breeze, see the Breeze Installation Guide.
After installing Breeze, you should verify that Breeze is
Now that you have your firewall installed and configured, you should
The simplest solution for multi-server solutions in a single location is to
For Breeze servers located in a cluster but sharing a public
In multi-server installations where there are multiple Breeze systems in