Wishing you all a great 2014. I hope this is the right section.

Basically we have a Dell Poweredge R520 server in our office, and we now want to install some accounting software that can be accessed remotely. Our local IT company is telling us that a new, separate server is needed for "Security reasons". It has been a really tough year for us, if this can be done on a software level, it would be great! I put forward an example of what Amazon does to see his reply.

Its running Windows Server 2008 R2 SP1, and is currently used for access control, as well as shared folders. It is completely under utilized for the specification, as we purchased it for future proofing reasons.

My questions is:

1) How easy would it be to setup a protected space for the Accounting software (Pastel) and what software would be needed? 2) Would you advise a separate server, or software based solution?

Here is his reply FYI:

"Happy new year too, wishing you all the best in 2014,

I think xxx has not explained what he wants to say well, so let me put it this way which I totally agree with him,

To have a virtual serves on one server, is quite very easy, like as u said, companies like amazon and others, have more than 100 virtual server on one physical server,

But if we are running one or two or three virtual server on one physical server, total cost of ownership is totally different, and disadvantages are many

To make any of the available servers run as a virtual host, we will need to buy Vmware Vshpere ESX license for it, which will cost not less than 5k USD along with the appropriate control software, that is excluding additional special backup softwares needed which might cost also around 2k USD,

Also, some of the disadvantages which we might face if we move the virtual environment, are as the following:

1- High risk of physical failure, what if the server crashed down, or at least the hard disc crashed down, by then we will lose instead of one server, 3 or 4 at the same time, which can make total breakdown of the whole operations

2- The above can be avoided, if we do two physical servers to live synchronize, but this also comes with a huge amount of spending on licenses, which can exceed 25k USD to apply it..

3- Performance of the virtual will not be the same as the physical one,

4- Very complicated to manage, in such a way that not any one can manage the servers, unless my team will be always controlling it, or I have to deploy one of the IT techs. to be always available !

As a conclusion, I advise that we user physical server for now, and if there is any future major upgrade consideration, then the Virtual environment can be studied well and considered,"

Your help would be greatly appreciated!

  • What else are you currently using this server for? – Xander Jan 20 '14 at 15:53
  • You should be able to run that configuration using the free version of VMware or Hyper-V. – Ben Jan 20 '14 at 16:42
  • @Xander To be honest, this company has been adding servers for everything. Anti-virus (An old one, low spec), one for a freight management software for bookings, and one (The R520) for the Pastel accounting software. I initially purchased the R520 for everything. Allegedly, the accounting software was conflicting with the freight management software and they were split. I am just getting a bit suspicious, especially as from my understanding, the accounting software is on the Dell. It would just be a case of setting up a VPN. I'll have full details tomorrow morning. – user41766 Jan 20 '14 at 17:48
  • @Ben That's interesting, and would be fantastic news! Let me get the full details tomorrow about of current setup, to be clear. I just asked one of our departments about the current setup, and they will confirm tomorrow. As far as they know, the accounting software has it's own server now (The R520), so it should just be a matter of setting up a VPN to it I should think. What do you think? I am not an IT expert, but have some basic knowledge, it just seems illogical to me to add a server each time. Many thanks for your help, it is greatly appreciated. – user41766 Jan 20 '14 at 17:54
  • You need to ask on SuperUser or Sysadmin. As always you need to understand enough to know whether the solution offered is appropriate. – Ben Jan 20 '14 at 18:20

As with any situation where you pay for security, it is a simple risk assessment calculation.

  • What could go wrong?
  • What would it cost me when it goes wrong?
  • How likely is it that it goes wrong?
  • What would it cost me to avoid this scenario?

When you run two applications on one server, it is possible that application A has a serious security vulnerability which will give anyone who has access to A (even partial) full access on application B. When you consider doing this, you have to ask yourself "What would that cost me"? We don't know what your business is about and how confidential your data is, so we can't do this calculation for you.

When a system hosts an outward-facing application (like a webserver or a VPN server), the whole world has limited access to it. So a small security flaw could mean that any other application on the server becomes fully accessible to the whole world. This can theoretically also happen for a software which requires authentication. When the authentication mechanism of your accounting software has a major flaw, it could allow anyone from the internet to login and overtake the accounting software. How much more expensive would the damage be when they would then also have full access to the other applications running on the server?

But when you have two applications which are only avaliable on your LAN, and a privilege escalation wouldn't give anyone the right to do anything they couldn't do otherwise, there is really no reason not to put them onto the same machine (security-wise).

Running multiple virtual servers on one physical server can save costs and improve security, but while virtualization builds a barrier between applications which is much higher than when they would run on the same operating system, this barrier isn't as impenetrable as separate hardware. All virtualization softwares had their security vulnerabilities in the past which allowed one VM access to another VM or the host.

Regarding the cost estimates by your vendor to set up a virtualization with 3-4 virtual servers (5k for a vSphere license, 25k for a redundant server, 24/7 support required), I believe these to be overdimensioned. But neither am I a sysadmin, nor is this on-topic here. You might get a much better and more detailed estimation about what you really need from the real sysadmins on http://serverfault.com

  • Many thanks for your detailed response. The problem is, I am based in Africa, and a fully qualified sysadmin is impossible to find unless you hire and base him/her here. Since our needs are small, we can't afford it, and outsource. We loose control, as it was in this case. – user41766 Jan 22 '14 at 15:36

Your Answer

