Secure, Remote File Storage

[marco99]

I have a general architecture question that I wanted to pose to everyone for feedback. I have an Extranet application based on CF 6.1 Enterprise which is designed to provide basic document management services by allowing people to upload and download files. The application is designed with CF and IIS on the same server, with a firewall, reverse proxy, etc. in front of the server. I have a security concern with the application in that the files that are uploaded are stored on the Extranet server. This was originally done as it was the easiest solution and made the Verity indexing of the document easy. However, I'd like to move the documents off of the server for security reasons, but 1) still give people the ability to upload and download docs through the Extranet CD application and 2) still index the documents to allow user searches. My question is how have others of you done similar stuff? What is the best way to move the files (cfftp, mapped OS drive, etc.)? Does indexing the files require a separate Verity K2 license? If I recall, Verity K2 is something like $65k, which wouldn't be my first choice. Any thoughts?

[kim_il_sung]

hi
at one similar project (without verity btw) solution was to simple move application filestorage to other server and just mapped drive

cheers
kim

[marco99]

Kim - thanks for the quick response. Indeed, I think that a mapped drive is likely the easiest, quickest solution. I'm not sure, however, how much additional security it affords if the Extranet server was to become compromised. I suspect using FTP to transfer the files may be more secure. What I'm wondering if there are other ways (maybe more typical or more secure) and what can be done to effectively index the documents for searchability without a costly Verity K2 implementation. Perhaps FTP and Verity K2 is the answer, but I'm interested in feedback from people that have tackled this problem like you. Thanks again.

[kim_il_sung]

hi
ftp sucks vs file mapping. you can, if properly config, get better security with file wrights than ftp(what is running sys rights per dir/user or something like at worst). if wanted you can inplement somthing extra like .htaccess or other if you like.
but hey its my 2 cents man.

cheers
kim