OpenCyber Academy
Bachelor's · Chapter 30 · English
Course code: OCA-104Chapter 30: OCA-104-C030

Chapter 30 — Laboratory II

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 30 published. Map, example, EX088.

flowchart TD
  N0["Learning outcomes"]
  N1["30.1 Purpose"]
  N2["Lab — server services"]
  N3["30.2 Reading the result"]
  N4["30.3 Removal"]
  N5["30.4 Verification"]
  N6["Fewer services, fewer worries"]
  N7["Checking with owners"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX088"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["30.1 Purpose"]
  N2["Lab — server services"]
  N3["30.2 Reading the result"]
  N4["30.3 Removal"]
  N5["30.4 Verification"]
  N6["Fewer services, fewer worries"]
  N7["Checking with owners"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX088"]

[Learning outcomes]
    |
    v
[30.1 Purpose]
    |
    v
[Lab — server services]
    |
    v
[30.2 Reading the result]
    |
    v
[30.3 Removal]
    |
    v
[30.4 Verification]
    |
    v
[Fewer services, fewer worries]
    |
    v
[Checking with owners]
    |
    v
[Worked example] --> [Exercise EX088]

Learning outcomes

You will (1) compare running services with documented needs; (2) remove unneeded services; (3) verify servers.

30.1 Purpose

Applying SP 800-123's advice to Bramley's servers.

The lab compares each server's running services with the needed services listed in its role document. Anything running on a server but not listed in its role document is reported as unneeded. The comparison is run before any change and again after removal, so the result can be verified rather than assumed. The comparison follows SP 800-123's advice to remove services a server does not need, using each role document as the definition of need.

Lab — server services

"""Compare running services on synthetic servers with documented needs, per SP 800-123 (stdlib only)."""
servers = {"BHA-S01 file": ({"smb", "backup-agent", "mgmt-agent", "print-spooler", "telnet"}, {"smb", "backup-agent", "mgmt-agent"}),
           "BHA-S02 finance": ({"db", "backup-agent", "mgmt-agent", "web-admin"}, {"db", "backup-agent", "mgmt-agent"}),
           "BHA-S03 domain": ({"directory", "dns", "mgmt-agent", "backup-agent"}, {"directory", "dns", "mgmt-agent", "backup-agent"}),
           "BHA-S04 old-app": ({"legacy-app", "ftp", "mgmt-agent"}, {"legacy-app", "mgmt-agent"})}
t = 0
for s, (run, need) in servers.items():
    extra = sorted(run - need); t += len(extra)
    print(f"{s}: {'ok' if not extra else 'unneeded: ' + ', '.join(extra)}")
print(f"unneeded services {t}")

Run with python3 lab_services.py. Verified output:

BHA-S01 file: unneeded: print-spooler, telnet
BHA-S02 finance: unneeded: web-admin
BHA-S03 domain: ok
BHA-S04 old-app: unneeded: ftp
unneeded services 4

30.2 Reading the result

Four unneeded services: print-spooler and telnet on the file server, web-admin on finance and ftp on the old application server. The domain server is fine.

Three of the four servers carry at least one leftover, and the file server carries two. The print spooler is left from the time printers were shared through the file server, which the role document no longer lists. Telnet and ftp both send passwords without encryption, so they matter more than their count suggests. The web-admin console on the finance server is used occasionally by the finance team, which is why it needs a replacement rather than simple removal.

30.3 Removal

Each is disabled after checking with users and testing.

Gareth asks the server owner and the contractor before each change, then disables one service at a time and waits a week before the next. Each change has a note on how to turn the service back on, and the matching firewall rule is removed with it. The finance team's occasional use of web-admin is moved to remote access through the admin workstation before the console is switched off, so no workflow breaks.

30.4 Verification

A re-run shows zero unneeded services.

The rerun prints "ok" for all four servers and reports zero unneeded services, against four at the baseline. Aisha saves the output with its date beside the first run, so the before and after evidence sit together. The lab then joins the monthly part of the routine, because new software installs can quietly add services again, and the role documents remain the list it checks against. A new service found by a later run is either added to the role document with a reason or disabled.

Fewer services, fewer worries

Every running service is code that must be patched and configured. Saltzer and Schroeder (1975) described economy of mechanism and least privilege: keep systems as simple as possible and give each part only what it needs. The CIS Benchmarks put this into practice by recommending that unneeded services be disabled.

Aisha's lab compares each server's running services against its role document. The file server still runs a print spooler, although printers now connect directly, and an old telnet service; the finance server runs a web-admin console; and the old application server runs ftp. Four services in total are unneeded.

Gareth disables them one at a time, after checking with users and noting each change. He waits a week between changes so any problem can be traced to a single step. No problems appear.

The role documents and the service list now agree, and the lab runs monthly to catch new services that appear after software installs.

Checking with owners

Before turning anything off, Gareth asks the server owner and the contractor whether the service is used. Asking first avoids surprises and builds trust.

Worked example

The finance team uses web-admin occasionally. It is replaced by remote access through the admin workstation.

Synthetic case. Synthetic.

Errors and limits

Removing services without asking users can break workflows.

Exercises

Synthesis

Remove unneeded services and verify.

Continue studying — chapter 30 of 40

← Chapter 29 (draft) · Course chapter index · Chapter 31 (draft) →

Worked answers

EX088. Four: print-spooler and telnet on file, web-admin on finance, ftp on old app.

EX089. Zero unneeded services.

EX090. Remote access through the admin workstation.