DMZ至内部网络的安全高效数据传输协议选型咨询
Hey there! Given your need to move non-sensitive real-time test data from the DMZ to your internal network—while avoiding the security risks of SMB post-WannaCry—I’ve got a few solid protocol recommendations tailored to different use cases:
1. SSH-Based Protocols (SCP/SFTP/Rsync over SSH)
These are the workhorses of secure file transfer, perfect if you’re dealing with file-based test data:
- SFTP: A secure alternative to FTP that runs over SSH. It supports directory transfers, resume capabilities, and encrypted communication out of the box. It’s widely supported across all OSes, and you only need to open port 22 on your firewalls (easy to lock down with IP whitelisting).
- Rsync over SSH: Ideal for efficient incremental transfers. Rsync only sends the parts of files that have changed, saving bandwidth and speeding up real-time syncs. The SSH layer ensures all data is encrypted in transit, so you don’t have to worry about eavesdropping.
- SCP: A simpler option for one-off or small file transfers, though SFTP is more flexible for most real-time use cases.
2. HTTPS (with WebSocket for Real-Time Streams)
If your test data is delivered as a real-time stream or via API endpoints, HTTPS is a fantastic choice:
- It uses TLS encryption to secure all data in transit, and port 443 is often already allowed through firewalls (though you should still restrict access to specific internal IPs).
- For true real-time push scenarios, pair HTTPS with WebSocket: this maintains a persistent, low-latency connection between your DMZ service and internal test systems, making it great for live updates like sensor data or test metrics.
- Most development frameworks have robust libraries for building HTTPS/WebSocket services, so implementation is straightforward.
3. MQTT over TLS
For lightweight, low-bandwidth real-time data (like IoT test data or small message payloads), MQTT with TLS encryption is a top pick:
- MQTT is a publish-subscribe protocol designed for constrained environments, so it uses minimal resources on both the DMZ sender and internal receiver.
- Adding TLS ensures all messages are encrypted, and you can configure access controls (like username/password or client certificates) to restrict which internal systems can subscribe to the data.
- It’s perfect for scenarios where you need to push real-time updates to multiple internal test systems simultaneously.
Why These Beat SMB
SMB’s history of critical vulnerabilities (like EternalBlue, which fueled WannaCry) makes it a risky choice for cross-zone transfers, even with non-sensitive data. All the protocols above are designed with security as a core feature: they use strong encryption by default, have smaller attack surfaces, and are easier to harden with firewall rules and access controls.
Quick Decision Guide
- File-based real-time sync: Go with Rsync over SSH or SFTP
- Real-time API/streaming data: Use HTTPS + WebSocket
- Lightweight, low-bandwidth messages: MQTT over TLS
内容的提问来源于stack exchange，提问作者Castr3l
