There are zillions of Internet services out there and if you're going to harden them well the main thing
you're going to be doing is use a secure protocol so if you read the questions on the exam.
Always think in terms of security so don't use regular FTB use a secure FGP if you're doing some kind
of file transfer if you're going to be using terminals.
Don't use telnet.
Use S-sh if you're going to be doing web stuff.
Use HTP.
Don't use HTP.
And by the way I've got entire episodes that cover these and their port numbers in particular the port
numbers.
So you might want to refer back to those so you're going to run into lots of questions on the exam and
they're going to be like long files and stuff like that and you're going to be looking for problems
in general insecure protocols are always a bad idea.
So when you're going through this stuff make sure when you get questions like this that you're looking
for insecure protocols and there's nothing better you can do to harden the service than to dump the
insecure and go with the Secure.
However there are two protocols in particular two services in particular that I don't really cover well
enough and I want to take a moment to do that right now.
So let's start with good old DNS
DNS has been around since pretty much almost the beginnings of the Internet.
Now DNS runs on port 53 remember that and DNS from the beginning has been a completely insecure protocol.
I mean there is absolutely nothing there at all so let's make sure we understand how DNS works.
So here's my computer over here and he needs the IP address for something.
So this computer over here goes up to his DNS server.
Every computer's got a DNS server and now this DNS server is going to march through the DNS hierarchy
I don't want to go through all that let's just add one DNS server.
So this DNS server will then talk to his upstream DNS server in an attempt to resolve.
Now it could go higher from there but eventually this DNS server is going to come back with the IP information
which is then passed down to the client.
The problem here is that it's trivial for let's put another computer in here that acts as a buffer.
So he's in essence doing a man in the middle attack and is intercepting these DNS requests and sending
my poor client off to some scary strange place in the late 1990s.
DNS SEC was forwarded as a tool to force authentication of DNS servers to make this work a DNS SEC capable
server generates a key pair and it has upstream DNS server signed them creating new DNS records for
each zone.
So you'll get records like this.
Now what's important is you'll notice this one is a public signing key.
So let's watch how all this works together.
So now once again the little individual client's going to go up to his DNS SEC capable DNS server and
make a request.
This time the DNS server is going to go ahead and make a request to the upstream server just like he
did before.
But he's also going to ask for the key from that upstream server.
That way he can go ahead and authenticate to verify that he really is getting DNS information from that
upstream server.
No man in the middle attack fears.
There's two things I need you to know about DNS sec.
Number one DNS SEC is not an encryption.
It's purely an authentication tool so it doesn't hide the DNS requests it just prevents man in the middle.
Also dnssec has become quite popular on public DNS servers.
A lot of the most famous DNS servers out there like Google's famous 8. 8 8 8 8 are fully dnssec capable.
OK the next thing I want to take a quick look at is e-mail
e-mail at least the original S-M T-P pop and IMAP protocols have always been totally insecure and this
has always been a big issue.
Now not that terribly long ago we came up with secure versions of IMAP POP and S-M t.p So let's go through
all of these.
Let's start with a.p.
Here I have my computer that is local with some email client on it.
And way over here is the A.P. server for the person I want to send email to.
Now I'll use DNS to get the IP address of this Esam t.p server.
But once I have that once I make that connection all the data that I'm sending is completely in the
clear with secure S.M. teepee.
All we're doing is we're creating a less connection between my client system and the A.P. server.
So the data is sent with authentication and encryption.
Now MTV by itself will just use port 25.
But if you're using SSL slash TS encrypted as a.p it's going to be either using port for sixty five
or five 87.
That was so much fun let's do it again except this time let's do it with IMAP and pop.
So here's my individual client system and here's my IMAP or pop server they were equally the same.
Now normally I would just log in in the clear to my I'm pop server and get my email.
So everything's in the clear.
Even my passwords in the clear here.
Now what we'll use instead is something called Start T.L. s start TLM is just an extension to IMAP and
pop protocols.
All that does is basically my client will sit there and say hey can we make a start TLM connection my
server will we respond.
Yes and it will immediately be put into a Teale s encrypted tunnel.
Now normally I'm going to use port 1:43 But if we're using SSL T.L. s encrypted I map it's gonna be
using port 993.
Pop would normally use 110 but encrypted pop uses port nine ninety five.
The big takeaway here when it comes to Internet service hardening is use secure protocols.
Make sure that you always know that there's a secure protocol option available and also make sure you're
comfortable with the terminology here.
Make sure you know about DNS sec.
Make sure you know about starting less and the different types of protocols they are attributed to.