Database, Mail and DNS Hardening

When a Database Credential Becomes a Shell

A database server runs as its own user with read and write access to its data folder, and sometimes more. MySQL's LOAD DATA and SELECT ... INTO OUTFILE read and write files with that access; secure_file_priv confines them to one folder or, set to NULL, disables them. With symbolic links allowed, a table can point outside the data directory. Redis CONFIG SET can change the directory and file name it saves to. That is the classic route from an exposed Redis to a cron job or an SSH key. FLUSHALL wipes every key in one command. Renaming those commands, or better an ACL that denies @dangerous for application users, limits what a stolen credential can do.

These are configuration-file signals only. OpenVAPT never connects to the database, so it cannot see anonymous users or a leftover test database; check those with the vendor's own tools under administrator credentials.

Passwords and Transport

PostgreSQL's md5 method stores a value that works as the password itself, so a copied catalog is a copied set of credentials. The password method sends the password in the clear unless the session is encrypted. SCRAM-SHA-256 fixes both and is the default since PostgreSQL 14. Migrating safely means setting password_encryption first, having every role reset its password so a SCRAM verifier exists, and only then changing the pg_hba.conf methods.

ssl = on in PostgreSQL and require_secure_transport = ON in MySQL make encryption a server rule rather than a client option. skip-name-resolve in MySQL stops grants depending on DNS answers that an attacker on the path can forge. log_error and log_connections turn silent events, including every successful login, into evidence.

Mail: Offer TLS, Require TLS, Say Nothing Extra

Postfix smtpd_tls_security_level = may with a real certificate is what other mail servers expect; none means every message arrives in the clear. The default protocol list still admits TLS 1.0 and 1.1, so set smtpd_tls_protocols and smtpd_tls_mandatory_protocols to >=TLSv1.2. disable_vrfy_command = yes stops address enumeration. Dovecot ssl = required refuses any command before TLS, which completes the plaintext-authentication control: with ssl = yes a client may still keep the whole session unencrypted.

DNS: Hide the Version, Validate the Answers

A CHAOS query for version.bind returns the exact BIND release unless options sets a version string. DNSSEC validation (dnssec-validation auto) lets a recursive resolver reject forged answers for signed zones. BIND 9.16 and newer enable it by default. An explicit no is a deliberate weakening and the one state OpenVAPT flags.

In Summary

Databases, mail and DNS fail the same way: they listen too widely, trust too much and say too much. Bind to what you need, and require strong password verifiers and TLS on the wire. Rename or restrict dangerous commands, and offer and require TLS for mail. Hide the DNS version and validate answers with DNSSEC.

Apply It

These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.

Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.

Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.

Lab

1. Run: openvapt demo --only NET-DB-,NET-MAIL-,NET-DNS- --out p16 and group the findings into three buckets: limits what a credential can do, makes transport encrypted, produces evidence.
2. Read /etc/mysql/conf.d/hardening.cnf, the PostgreSQL files and redis.conf in the hardened lab (internal/lab/fixtures_servers_db_mail.go) and write one sentence per line on what it prevents.
3. Write the ordered steps to move a PostgreSQL 13 cluster from md5 to scram-sha-256 without locking out the application, and say what breaks if the order is wrong.
4. On a test resolver: dig @127.0.0.1 version.bind txt chaos +short and dig @127.0.0.1 dnssec-failed.org a ; explain what each answer shows.

Check Yourself

Answers are checked in your browser and never stored or sent.

References

• MySQL 8.4 Reference Manual, Security Guidelines
• PostgreSQL, Password Authentication
• Redis Security
• Postfix TLS Support
• Dovecot SSL/TLS Configuration
• NIST SP 800-81 Rev. 2, Secure Domain Name System Deployment Guide
• NIST SP 800-177 Rev. 1, Trustworthy Email

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.

OpenVAPT. (2026). P19: Database, Mail and DNS Hardening (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/p19.html

@misc{openvapt_p19,
  author       = {{OpenVAPT}},
  title        = {{P19: Database, Mail and DNS Hardening}},
  year         = {2026},
  howpublished = {\url{https://openvapt.com/academy/p19.html}},
  note         = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}