For Teachers · Back to the Module · Print with your browser's Print command.

P19 Worksheet: Database, Mail and DNS Hardening

Student Worksheet (about 30 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: P8

Learning Objectives

• [ ] Read MySQL, PostgreSQL and Redis option files and name the setting behind each finding.
• [ ] Explain why secure_file_priv, symbolic links and Redis administrative commands turn a database credential into a server compromise.
• [ ] Move PostgreSQL from md5 to SCRAM-SHA-256 without locking users out.
• [ ] Harden Postfix and Dovecot TLS, disable VRFY, and hide the BIND version while keeping DNSSEC validation on.

Key Terms

Write each definition in your own words.

• SCRAM-SHA-256: ______________________________________________
• DNSSEC: ______________________________________________
• STARTTLS: ______________________________________________
• Least Privilege: ______________________________________________
• Open Relay: ______________________________________________
• Hardening: ______________________________________________

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only NET-DB-,NET-MAIL-,NET-DNS- --out p16 and group the findings into three buckets: limits what a credential can do, makes transport encrypted, produces evidence.
2. Read /etc/mysql/conf.d/hardening.cnf, the PostgreSQL files and redis.conf in the hardened lab (internal/lab/fixtures_servers_db_mail.go) and write one sentence per line on what it prevents.
3. Write the ordered steps to move a PostgreSQL 13 cluster from md5 to scram-sha-256 without locking out the application, and say what breaks if the order is wrong.
4. On a test resolver: dig @127.0.0.1 version.bind txt chaos +short and dig @127.0.0.1 dnssec-failed.org a ; explain what each answer shows.

Self-Check Questions

1. What does secure_file_priv = NULL do?

• [ ] a) Disables password checks
• [ ] b) Disables file import and export statements entirely
• [ ] c) Deletes the data directory
• [ ] d) Allows file import and export from any folder

1. Why is a PostgreSQL md5 verifier worse than it sounds?

• [ ] a) It is slow
• [ ] b) The stored value itself authenticates, so a leaked catalog is a leaked password set
• [ ] c) It only works over IPv4
• [ ] d) It cannot be used over TLS

1. What is the correct order when moving to SCRAM-SHA-256?

• [ ] a) Change pg_hba.conf first, then passwords
• [ ] b) Set password_encryption, reset every password, then change pg_hba.conf
• [ ] c) Reinstall PostgreSQL
• [ ] d) Change passwords only; pg_hba.conf does not matter

1. Dovecot has ssl = yes. Can a client read mail without TLS?

• [ ] a) No, yes means mandatory
• [ ] b) Yes, TLS is offered but not required; ssl = required refuses plaintext sessions
• [ ] c) Only on port 993
• [ ] d) Only if the client uses IPv6

1. Why is Redis CONFIG SET dangerous on an exposed Redis?

• [ ] a) It can change where Redis saves its data, a classic route to a cron job or SSH key
• [ ] b) It only changes the memory limit
• [ ] c) It restarts Redis
• [ ] d) It encrypts every key

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• MySQL 8.4 Reference Manual, Security Guidelines: https://dev.mysql.com/doc/refman/8.4/en/security-guidelines.html
• PostgreSQL, Password Authentication: https://www.postgresql.org/docs/current/auth-password.html
• Redis Security: https://redis.io/docs/latest/operate/oss_and_stack/management/security/
• Postfix TLS Support: https://www.postfix.org/TLS_README.html
• Dovecot SSL/TLS Configuration: https://doc.dovecot.org/main/core/config/ssl.html
• NIST SP 800-81 Rev. 2, Secure Domain Name System Deployment Guide: https://csrc.nist.gov/pubs/sp/800/81/r2/final
• NIST SP 800-177 Rev. 1, Trustworthy Email: https://csrc.nist.gov/pubs/sp/800/177/r1/final

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.