Data Services: Databases, File Shares, DNS and Mail

Databases and Caches

Redis, MongoDB, Elasticsearch and Memcached were designed for trusted networks and have historically shipped without authentication. Exposed instances are found by internet-wide scanners within hours and wiped or ransomed. PostgreSQL 'trust' entries in pg_hba.conf allow login with no password at all, and MySQL's local_infile lets a compromised application read server files.

The safe pattern is the same everywhere. Bind to 127.0.0.1 or a private interface and require authentication. Let only the application servers that need access through the firewall.

File Shares

NFS exports with no_root_squash let a remote root user act as root on the share, and exports to '*' let anyone mount them. Samba shares with guest access, or servers still allowing SMB1, expose files to anonymous users and to old, wormable protocol flaws.

DNS and Mail

A DNS server that answers recursive queries for anyone is used to amplify denial-of-service attacks. One that allows zone transfers to anyone publishes the whole internal name map. A mail server whose relay rules are too broad becomes a spam relay, and allowing passwords over unencrypted connections exposes mail accounts.

In Summary

Databases, file shares, DNS and mail should listen only where they are needed. Default accounts, open relays and open recursion invite abuse.

Apply It

These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.

Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.

Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.

Lab

1. Run: openvapt demo --only NET-DB- --out p8 and read the evidence for each data service.
2. For each finding, name the single configuration line that fixes it.
3. On your own server: ss -tlnp and match each database or cache port to its bind setting.

Check Yourself

Answers are checked in your browser and never stored or sent.

References

• OWASP Database Security Cheat Sheet
• CISA, DNS Amplification Attacks (Alert TA13-088A)
• Redis security

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.

OpenVAPT. (2026). P8: Data Services: Databases, File Shares, DNS and Mail (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/p8.html

@misc{openvapt_p8,
  author       = {{OpenVAPT}},
  title        = {{P8: Data Services: Databases, File Shares, DNS and Mail}},
  year         = {2026},
  howpublished = {\url{https://openvapt.com/academy/p8.html}},
  note         = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}