For Teachers · Back to the Module · Print with your browser's Print command.

P8 Teacher Answer Key: Data Services: Databases, File Shares, DNS and Mail

Teacher Answer Key (about 30 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: P3

Learning Objectives

• [ ] Explain why databases and caches must require authentication and bind to loopback.
• [ ] Recognise unsafe NFS exports and Samba guest access.
• [ ] Explain open DNS recursion, zone transfers and open mail relays.

Key Terms

Write each definition in your own words.

• Attack Surface: All the points where an attacker could try to interact with a system, such as listening ports, web pages and accounts.
• Default Deny: A firewall or access policy that blocks everything except what is explicitly allowed.
• Open Relay: A mail server that forwards mail from anyone to anyone, which spammers abuse.
• DNS Recursion: A DNS server resolving names on behalf of clients; open to everyone, it can amplify denial-of-service attacks.
• Cleartext: Data sent or stored without encryption, readable by anyone who can see it.

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only NET-DB- --out p8 and read the evidence for each data service.
2. For each finding, name the single configuration line that fixes it.
3. On your own server: ss -tlnp and match each database or cache port to its bind setting.

Self-Check Questions

1. Why are exposed Redis or MongoDB instances so often breached?

• [ ] a) They are slow
• [x] b) They historically ran without authentication and are found quickly by internet-wide scanners
• [ ] c) They use too much memory
• [ ] d) They cannot use TLS
• Answer: b. Unauthenticated, internet-reachable data services are found and abused within hours.

1. What does no_root_squash on an NFS export allow?

• [x] a) A remote root user to act as root on the share
• [ ] b) Faster file copies
• [ ] c) Encrypted transfers
• [ ] d) Maps remote root to the nobody user
• Answer: a. Root on a client keeps root rights on the share. Mapping root to nobody is what root_squash does.

1. Why is open DNS recursion dangerous?

• [ ] a) It slows name resolution
• [x] b) It can be abused to amplify denial-of-service attacks
• [ ] c) It deletes zones
• [ ] d) It reveals the server's private keys
• Answer: b. Open resolvers send large answers to forged addresses, amplifying traffic toward victims.

1. A DNS server allows zone transfers to anyone. What does that reveal?

• [ ] a) The DNS server's password
• [x] b) The whole internal name map
• [ ] c) The site's TLS certificate
• [ ] d) Nothing, zone data is always public
• Answer: b. A zone transfer hands over every name in the zone, including internal hosts.

1. pg_hba.conf has a 'trust' entry. What does it allow?

• [x] a) Login with no password for matching connections
• [ ] b) Login only with a client certificate
• [ ] c) Read-only access
• [ ] d) Login only through the firewall
• Answer: a. trust skips authentication entirely for connections that match the line.

1. What is the safe pattern for a database server?

• [ ] a) Bind to 0.0.0.0 and rely on a strong password
• [x] b) Bind to 127.0.0.1 or a private interface, require authentication, and allow only the application servers through the firewall
• [ ] c) Move it to a non-default port
• [ ] d) Turn off its logs
• Answer: b. The same three layers apply to every data service: narrow binding, authentication and firewall rules.

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• OWASP Database Security Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Database_Security_Cheat_Sheet.html
• CISA, DNS Amplification Attacks (Alert TA13-088A): https://www.cisa.gov/news-events/alerts/2013/03/29/dns-amplification-attacks
• Redis security: https://redis.io/docs/latest/operate/oss_and_stack/management/security/

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.