Auditing file-sharing services: SMB, NFS, FTP
You audit SMB, NFS, FTP, rsync and WebDAV shares: you find guest access, share and file permissions, old protocol versions and forgotten sensitive files, harden them and follow access in the logs.
Level 201 · 17 lessons · 18 practice labs
Lessons
SMB
- How SMB works: shares, sessions, versions
- Auditing null sessions and guest access
- Auditing SMB share configuration: share and file permissions
- Auditing SMB signing and the old SMBv1 protocol
- Finding sensitive files forgotten on shares
- Short task: find and fix the wrong permissions on a Samba server
NFS
- Listing and reading NFS exports
- root_squash and no_root_squash: whose rights a write uses
- Exporting NFS only to the clients that need it
- Short task: harden an NFS export and verify it
FTP and others
- Anonymous access and writable directories on FTP
- Cleartext FTP: planning the move to SFTP and FTPS
- Auditing rsync modules and WebDAV shares
- Short task: close three misconfigurations on the FTP server
Monitoring and reporting
- Following share access in the logs
- Classifying the data on a share and finding its owner
- Capstone: audit and report every file share on an office network
Practice labs
- Check null-session access on an SMB server: Try connecting to the lab Samba server without credentials and record what can be listed in the findings table.
- Find and close the share open to guest access: Close the guest-accessible share on Mavikaya Lojistik's file server and verify that unauthenticated connections are refused.
- Close guest access without breaking a dependent legacy app: Create a dedicated service account for the scanner device that uses the guest share, disable guest access and test both sides.
- Audit this SMB share's permissions and report them: Extract the share and file permissions of Ayçiçeği Gıda's four shares and record the world-writable ones in the report table.
- Resolve a conflict between share and file permissions: The finance share has narrow share rights but broad file rights; work out the effective access, make them consistent and test with two users.
- Reduce wrong permissions on a Samba server to least privilege: Re-authorise the five shares on Sedirli Hukuk Bürosu's server according to the role table and re-verify access with each role.
- Check whether the old SMB version is enabled: List the SMB versions the lab file servers support and flag those that accept the old version.
- Make SMB signing mandatory and verify it: Make signing mandatory on the file server and verify from outside that unsigned connection attempts are refused.
- Apply the plan to retire the old SMB version and verify clients: Find Ilgıntepe Tekstil's clients that depend on the old version, update them, disable it and test that every client still connects.
- Find sensitive files left on shares: Search the lab shares for files containing passwords, keys and personal data and list each with its location and type.
- Classify the data on a share and find its owner: Classify the folders on the common share by confidentiality, identify each folder's owner and mark what must be moved.
- Monitor share access in logs and report unusual access: Enable Samba audit logging, find the account doing bulk reads outside working hours in a day of access records and write the incident note.
- List NFS exports and read who they are open to: List the lab NFS server's exports and tabulate which clients and options each is open to.
- Fix an export set to no_root_squash: Fix the export that allows unrestricted root writes with root_squash and verify from a client that writing as root is blocked.
- Open an NFS share only to the clients that need it: Narrow Kuzeyyıldızı Kargo's network-wide backup export to two servers, make it read-only and test a mount from an unlisted client.
- Find anonymous and writable FTP directories: Audit anonymous access and writable directories on the lab FTP server and record the findings with directory paths.
- Fix three misconfigurations on an FTP server: Fix anonymous login, the writable root directory and unencrypted sessions on Karaçam Mobilya's FTP server and retest each.
- Audit rsync modules and a WebDAV share: Find the unauthenticated rsync module and the writable WebDAV directory, add authentication to both and write the SFTP migration plan.
About this course
You audit SMB, NFS, FTP, rsync and WebDAV shares: you find guest access, share and file permissions, old protocol versions and forgotten sensitive files, harden them and follow access in the logs.
What you will learn
- SMB
- NFS
- FTP and others
- Monitoring and reporting
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.