Auditing infrastructure services: LDAP, SMTP, SNMP and databases
You audit directory, mail, network management, database and cache services: you find anonymous access, open relays, default community strings and password-less data stores, close them and report by business impact.
Level 301 · 19 lessons · 21 practice labs
Lessons
Directory and identity
- Auditing anonymous binds on LDAP
- User and group data visible from the directory
- Recognising Kerberos and domain services
- Short task: close anonymous access on an LDAP server
Mail
- Auditing SMTP for open relay
- Closing user disclosure through VRFY and EXPN
- Auditing STARTTLS and certificates on SMTP
- Short task: audit and fix the mail server’s configuration
Network management
- Auditing SNMP community strings: public and private
- Moving to SNMPv3: authentication and encryption
- Exposure of NTP and syslog services
- Short task: remove the default community string and configure SNMPv3
Databases and caches
- Auditing how exposed database ports are
- Default and password-less database accounts
- Redis and Memcached: closing unauthenticated access
- MongoDB and Elasticsearch: data stores left open
- Short task: restrict database and cache services to the application network only
Report
- Ranking infrastructure findings by business impact
- Capstone: audit and report the infrastructure services of a data-centre segment
Practice labs
- Check anonymous binds on an LDAP server: Bind anonymously to the lab LDAP server and record which user and group details can be read in the findings table.
- Disable anonymous LDAP access and verify applications: Disable anonymous reads, create a read-only service account for the application and test that it can still log in.
- Restrict sensitive attributes exposed from the directory: Map who can see the phone, description and password-hint attributes in Göktaşı Yazılım's directory and narrow the access lists.
- Check whether the mail server is an open relay: Try relaying a message to an outside domain through the lab mail server and record the result with the evidence line.
- Close an open relay and allow only the internal network: Limit relaying on Ayçiçeği Gıda's mail server to the internal network and authenticated users and show the outside attempt is refused.
- Find and close the relay gap on the backup mail server: Prove that the backup mail server relays while the primary is clean, align the configuration and retest both servers.
- Check whether VRFY and EXPN leak user information: Test whether the VRFY and EXPN commands confirm user existence on the lab mail server and write the finding.
- Disable the user-query commands and verify: Disable VRFY and EXPN on the mail server and retest that responses are uniform and valid users cannot be told apart.
- Fix STARTTLS and certificate settings and report: Enable the missing STARTTLS on Lodoskaya Denizcilik's mail server, renew the expired certificate and verify with an outside connection, then report.
- Check for default SNMP community strings: Test whether the public and private community strings are accepted on lab network devices and tabulate the results.
- Remove the default community string and narrow access: Remove the default string on the switch, allow reads only from the monitoring server and verify queries from other addresses get no answer.
- Configure the move to SNMPv3 and verify monitoring: Configure an authenticated, encrypted SNMPv3 user on Demirsu Enerji's lab device, disable v1 and v2c and show monitoring continues.
- Check the NTP service's exposure: Test whether the lab NTP server answers queries and status commands from the outside network and record it.
- Restrict the NTP service and retest: Disable status queries in the NTP configuration, limit the service to the internal network and verify by querying again from outside.
- Secure a syslog receiver that accepts anything: Limit a syslog receiver that accepts logs from any address to known devices and encrypted transport, and verify that a forged entry is rejected.
- Check database ports' network exposure: Scan the lab network for database ports and tabulate the databases reachable from outside the application network.
- Close default and passwordless database accounts: Find default and passwordless accounts in Narçiçeği Eczaneleri's database, remove them or set passwords and verify login is refused.
- Restrict database and cache services to the application network: Open three data services only to the application network via firewall and bind address, and prove closure with scans from other networks.
- Find a Redis instance without authentication: Find the cache service that requires no authentication in the lab network and record what data is reachable as a finding.
- Harden Redis and Memcached with authentication and local binding: Add a password and dangerous-command limits to Redis on Turnalı Perakende's server, bind Memcached to localhost and retest both.
- Close and report exposed document and search data stores: Lock down the document database and search cluster reachable without authentication in Lavinya Klinikleri's lab network, assess the exposed data and report by business impact.
About this course
You audit directory, mail, network management, database and cache services: you find anonymous access, open relays, default community strings and password-less data stores, close them and report by business impact.
What you will learn
- Directory and identity
- Mail
- Network management
- Databases and caches
- Report
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.