--- title: "P8: Data Services: Databases, File Shares, DNS and Mail" canonical: https://openvapt.com/academy/p8.html html: https://openvapt.com/academy/p8.html site: OpenVAPT, https://openvapt.com/ license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html modified: 2026-10-16 version: 0.1.0-alpha.6 --- # P8: Data Services: Databases, File Shares, DNS and Mail Why databases, caches, file shares, DNS and mail servers cause so many breaches, and the configuration settings that decide whether they are safe. - Level: Practitioner - Time: about 30 minutes - Read first: P3 ## You Will Be Able To - Explain why databases and caches must require authentication and bind to loopback. - Recognise unsafe NFS exports and Samba guest access. - Explain open DNS recursion, zone transfers and open mail relays. ## Databases and Caches Redis, MongoDB, Elasticsearch and Memcached were designed for trusted networks and have historically shipped without authentication. Exposed instances are found by internet-wide scanners within hours and wiped or ransomed. PostgreSQL 'trust' entries in pg_hba.conf allow login with no password at all, and MySQL's local_infile lets a compromised application read server files. The safe pattern is the same everywhere. Bind to 127.0.0.1 or a private interface and require authentication. Let only the application servers that need access through the firewall. ## File Shares NFS exports with no_root_squash let a remote root user act as root on the share, and exports to '*' let anyone mount them. Samba shares with guest access, or servers still allowing SMB1, expose files to anonymous users and to old, wormable protocol flaws. ## DNS and Mail A DNS server that answers recursive queries for anyone is used to amplify denial-of-service attacks. One that allows zone transfers to anyone publishes the whole internal name map. A mail server whose relay rules are too broad becomes a spam relay, and allowing passwords over unencrypted connections exposes mail accounts. ## In Summary Databases, file shares, DNS and mail should listen only where they are needed. Default accounts, open relays and open recursion invite abuse. ## Apply It - [NET-DB-001 Database or Cache Service Exposed to the Network](https://openvapt.com/checks/NET-DB-001.md) (high) - [NET-DB-002 Redis Authentication and Network Binding](https://openvapt.com/checks/NET-DB-002.md) (critical) - [NET-DB-003 MongoDB Authorization and Network Binding](https://openvapt.com/checks/NET-DB-003.md) (critical) - [NET-DB-004 PostgreSQL Trust and Broad Client Access](https://openvapt.com/checks/NET-DB-004.md) (critical) - [NET-DB-005 MySQL or MariaDB Unsafe Network Options](https://openvapt.com/checks/NET-DB-005.md) (high) - [NET-DB-006 Memcached UDP or Broad Listen Address](https://openvapt.com/checks/NET-DB-006.md) (high) - [NET-DB-007 Elasticsearch Security and Network Binding](https://openvapt.com/checks/NET-DB-007.md) (critical) - [NET-DB-008 Unsafe NFS Export Options](https://openvapt.com/checks/NET-DB-008.md) (high) - [NET-DB-009 Unsafe Samba Guest or SMB1 Configuration](https://openvapt.com/checks/NET-DB-009.md) (high) - [NET-DB-010 BIND Open Recursion](https://openvapt.com/checks/NET-DB-010.md) (high) - [NET-DB-011 BIND Zone Transfers Allowed to Any](https://openvapt.com/checks/NET-DB-011.md) (high) - [NET-DB-012 Postfix Open Relay Controls](https://openvapt.com/checks/NET-DB-012.md) (high) - [NET-DB-013 Mail Cleartext Authentication Allowed](https://openvapt.com/checks/NET-DB-013.md) (medium) - [NET-DB-014 MySQL Symbolic Links Allowed for Tables](https://openvapt.com/checks/NET-DB-014.md) (medium) - [NET-DB-015 MySQL secure_file_priv Not Restricted](https://openvapt.com/checks/NET-DB-015.md) (medium) - [NET-DB-016 MySQL Does Not Require Encrypted Client Connections](https://openvapt.com/checks/NET-DB-016.md) (medium) - [NET-DB-017 MySQL Error Log Not Configured](https://openvapt.com/checks/NET-DB-017.md) (low) - [NET-DB-018 MySQL Resolves Client Host Names](https://openvapt.com/checks/NET-DB-018.md) (low) - [NET-DB-019 PostgreSQL Uses md5 or password Authentication](https://openvapt.com/checks/NET-DB-019.md) (medium) - [NET-DB-020 PostgreSQL SSL Not Enabled](https://openvapt.com/checks/NET-DB-020.md) (medium) - [NET-DB-021 PostgreSQL Connection Logging Off](https://openvapt.com/checks/NET-DB-021.md) (low) - [NET-DB-022 PostgreSQL Password Encryption Not SCRAM](https://openvapt.com/checks/NET-DB-022.md) (medium) - [NET-DB-023 Redis Dangerous Commands Not Restricted](https://openvapt.com/checks/NET-DB-023.md) (medium) - [NET-SVC-002 Control Plane or Remote Desktop Ports Network-Reachable](https://openvapt.com/checks/NET-SVC-002.md) (critical) - [NET-SVC-003 Network Time Service Amplification Risk](https://openvapt.com/checks/NET-SVC-003.md) (high) ## Lab 1. `Run: openvapt demo --only NET-DB- --out p8 and read the evidence for each data service.` 2. `For each finding, name the single configuration line that fixes it.` 3. `On your own server: ss -tlnp and match each database or cache port to its bind setting.` ## Check Yourself Answer keys are public for every channel (see Teaching With OpenVAPT). 1. Why are exposed Redis or MongoDB instances so often breached? - A. They are slow - B. They historically ran without authentication and are found quickly by internet-wide scanners - C. They use too much memory - D. They cannot use TLS - Answer: B. Unauthenticated, internet-reachable data services are found and abused within hours. 2. What does no_root_squash on an NFS export allow? - A. A remote root user to act as root on the share - B. Faster file copies - C. Encrypted transfers - D. Maps remote root to the nobody user - Answer: A. Root on a client keeps root rights on the share. Mapping root to nobody is what root_squash does. 3. Why is open DNS recursion dangerous? - A. It slows name resolution - B. It can be abused to amplify denial-of-service attacks - C. It deletes zones - D. It reveals the server's private keys - Answer: B. Open resolvers send large answers to forged addresses, amplifying traffic toward victims. 4. A DNS server allows zone transfers to anyone. What does that reveal? - A. The DNS server's password - B. The whole internal name map - C. The site's TLS certificate - D. Nothing, zone data is always public - Answer: B. A zone transfer hands over every name in the zone, including internal hosts. 5. pg_hba.conf has a 'trust' entry. What does it allow? - A. Login with no password for matching connections - B. Login only with a client certificate - C. Read-only access - D. Login only through the firewall - Answer: A. trust skips authentication entirely for connections that match the line. 6. What is the safe pattern for a database server? - A. Bind to 0.0.0.0 and rely on a strong password - B. Bind to 127.0.0.1 or a private interface, require authentication, and allow only the application servers through the firewall - C. Move it to a non-default port - D. Turn off its logs - Answer: B. The same three layers apply to every data service: narrow binding, authentication and firewall rules. ## Key Terms - Attack Surface: All the points where an attacker could try to interact with a system, such as listening ports, web pages and accounts. - Default Deny: A firewall or access policy that blocks everything except what is explicitly allowed. - Open Relay: A mail server that forwards mail from anyone to anyone, which spammers abuse. - DNS Recursion: A DNS server resolving names on behalf of clients; open to everyone, it can amplify denial-of-service attacks. - Cleartext: Data sent or stored without encryption, readable by anyone who can see it. ## References - [OWASP Database Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Database_Security_Cheat_Sheet.html) - [CISA, DNS Amplification Attacks (Alert TA13-088A)](https://www.cisa.gov/news-events/alerts/2013/03/29/dns-amplification-attacks) - [Redis security](https://redis.io/docs/latest/operate/oss_and_stack/management/security/) Offline: `openvapt learn P8`. --- OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/academy/p8.html. Part of OpenVAPT Academy. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.