Chapter 6 — Networks for endpoint work
Lesson map
Lesson 06 published. Map, example, EX016.
flowchart TD
N0["Learning outcomes"]
N1["6.1 Addresses and ports"]
N2["6.2 Segmentation"]
N3["6.3 Host firewalls"]
N4["6.4 Remote access"]
N5["Name resolution"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX016"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["6.1 Addresses and ports"]
N2["6.2 Segmentation"]
N3["6.3 Host firewalls"]
N4["6.4 Remote access"]
N5["Name resolution"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX016"]
[Learning outcomes]
|
v
[6.1 Addresses and ports]
|
v
[6.2 Segmentation]
|
v
[6.3 Host firewalls]
|
v
[6.4 Remote access]
|
v
[Name resolution]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX016]
Learning outcomes
You will (1) explain addressing and ports; (2) describe segmentation; (3) use host firewalls.
6.1 Addresses and ports
Each device has an IP address, and each network service listens on a port: SSH on 22, web on 443, file sharing on 445. Knowing which ports a server exposes tells you which services can be reached. Tomás learns to list listening ports on a server with the ss command, a read-only check.
On a server, ss -tlnp lists listening TCP ports with the local address, which shows whether a service accepts connections from anywhere or only from the machine itself. That address is the difference between 0.0.0.0, meaning every network, and 127.0.0.1, meaning local only, and it is exactly what Tomás reads when he finds the database port on mis01.
6.2 Segmentation
The trust's network has a staff segment, a classroom segment and a server segment. Classroom devices should not reach the management information system server directly. Segmentation limits how far a problem on one device can spread, a principle NIST SP 800-53 Rev. 5 covers under boundary protection.
Tomás does not test the segmentation by trying to connect from a classroom device, which would be outside his agreement. Instead he reads the firewall rules between segments with Dev and checks whether any rule allows the classroom segment to reach mis01 or the other servers, recording each rule's purpose as Dev explains it.
6.3 Host firewalls
Each laptop and server also runs its own firewall. On Windows, Defender Firewall should be on for all profiles; on Linux, a tool such as nftables or ufw allows only needed ports. A host firewall still helps when a device joins an untrusted network, such as a teacher's home wireless.
The host firewall and the network segments protect different things: segments decide which networks can reach a server, while the host firewall decides which ports on that server answer. On mis01, the old database port open to all addresses is exactly the case a host firewall rule would have limited, even before the database configuration was changed to listen locally.
6.4 Remote access
The outside company connects to servers over a VPN. Tomás notes that the VPN account is shared by several engineers, which makes it impossible to tell who did what. He records this for the account work later.
With one shared account, the VPN log shows that someone from the company connected, but never which engineer, and the trust cannot check that person against the company's staff list. If one engineer leaves the company, the only way to remove their access is to change the password for everyone, which is disruptive enough that it tends to be postponed.
Name resolution
DNS turns names such as the trust's intranet address into IP addresses. Every connection a device makes starts with this lookup, so DNS settings quietly decide where traffic goes. If a laptop is pointed at an unknown resolver, perhaps by a home router or a public hotspot, lookups can be answered wrongly or logged by someone else. The trust's laptops use the trust's own resolver at school and a known filtering DNS service elsewhere, which also blocks many known malicious domains. Tomás checks the configured resolvers on his sample, finds one laptop with a manually set public resolver left from troubleshooting, and records it for correction.
Worked example
On mis01, ss shows SSH on 22, the application on 443 and an old database port open to all addresses; Tomás reports that the database should listen only locally.
Synthetic case. Network details are synthetic.
Errors and limits
A port open on a server is not automatically a problem; the question is whether it is needed and who can reach it.
Exercises
- EX016 — Reading exposure. What does a list of listening ports tell you? Rubric: 3 = which services can be reached, to compare against needs;; 2 = services;; 1 = vague;; 0 = none.
- EX017 — Segment purpose. Why keep classroom devices off the server segment? Rubric: 3 = limits spread and access to pupil data;; 2 = security;; 1 = vague;; 0 = none.
- EX018 — Shared VPN account. Explain the problem with a shared VPN account. Rubric: 3 = no accountability, hard to revoke one person;; 2 = accountability;; 1 = vague;; 0 = none.
Synthesis
Knowing ports, segments and firewalls lets you judge exposure without any attack tools.
Continue studying — chapter 06 of 30
← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →