I've been playing around with endpoints in SQL Server 2005
looking at how they can be used to enhance security for SQL
Servers servicing web servers based in the DMZ. Figure 1 shows a traditional architecture
for just such a web server / database combination. The web server
exists in the DMZ, outside of the trusted network. The SQL Server
exists inside the trusted network and the appropriate ports are
opened up in the firewall to allow the web server to connect back
to the SQL Server. Best practices would say only open the
necessary TCP port SQL Server listens on and no more. Since the
port can be specified in the connection string or through the use
of an alias, opening up UDP port 1434 isn't necessary for named
instances.
Figure 1: Typical Architecture for web server in DMZ
…
[Read more]