For Teachers · Back to the Module · Print with your browser's Print command.

P8 Worksheet: Data Services: Databases, File Shares, DNS and Mail

Student Worksheet (about 30 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: P3

Learning Objectives

• [ ] Explain why databases and caches must require authentication and bind to loopback.
• [ ] Recognise unsafe NFS exports and Samba guest access.
• [ ] Explain open DNS recursion, zone transfers and open mail relays.

Key Terms

Write each definition in your own words.

• Attack Surface: ______________________________________________
• Default Deny: ______________________________________________
• Open Relay: ______________________________________________
• DNS Recursion: ______________________________________________
• Cleartext: ______________________________________________

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only NET-DB- --out p8 and read the evidence for each data service.
2. For each finding, name the single configuration line that fixes it.
3. On your own server: ss -tlnp and match each database or cache port to its bind setting.

Self-Check Questions

1. Why are exposed Redis or MongoDB instances so often breached?

• [ ] a) They are slow
• [ ] b) They historically ran without authentication and are found quickly by internet-wide scanners
• [ ] c) They use too much memory
• [ ] d) They cannot use TLS

1. What does no_root_squash on an NFS export allow?

• [ ] a) A remote root user to act as root on the share
• [ ] b) Faster file copies
• [ ] c) Encrypted transfers
• [ ] d) Maps remote root to the nobody user

1. Why is open DNS recursion dangerous?

• [ ] a) It slows name resolution
• [ ] b) It can be abused to amplify denial-of-service attacks
• [ ] c) It deletes zones
• [ ] d) It reveals the server's private keys

1. A DNS server allows zone transfers to anyone. What does that reveal?

• [ ] a) The DNS server's password
• [ ] b) The whole internal name map
• [ ] c) The site's TLS certificate
• [ ] d) Nothing, zone data is always public

1. pg_hba.conf has a 'trust' entry. What does it allow?

• [ ] a) Login with no password for matching connections
• [ ] b) Login only with a client certificate
• [ ] c) Read-only access
• [ ] d) Login only through the firewall

1. What is the safe pattern for a database server?

• [ ] a) Bind to 0.0.0.0 and rely on a strong password
• [ ] b) Bind to 127.0.0.1 or a private interface, require authentication, and allow only the application servers through the firewall
• [ ] c) Move it to a non-default port
• [ ] d) Turn off its logs

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• OWASP Database Security Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Database_Security_Cheat_Sheet.html
• CISA, DNS Amplification Attacks (Alert TA13-088A): https://www.cisa.gov/news-events/alerts/2013/03/29/dns-amplification-attacks
• Redis security: https://redis.io/docs/latest/operate/oss_and_stack/management/security/

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.