advanced·20 min·مدفوع
Web Tier Bypasses App Tier
Security review finds the web servers can talk directly to the database — they shouldn't be able to
السيناريو
The customer-facing application is built in three tiers, each on its own subnet: a web tier that talks to the public Internet, an application tier that the web tier talks to for business logic, and a database tier that only the application tier is supposed to reach. A routine security review found that web-tier servers can connect directly to the database tier, completely bypassing the application tier — a serious defense-in-depth violation, since a compromised web server should never be able to touch the database directly.
أهداف التعلّم
- acl
- nftables
- least privilege
الطوبولوجيا والإعداد
تحتوي هذه البيئة على 4 جهازًا (3 Hosts, 1 Router). تقوم بإعداد واستكشاف أخطاء المهارات المذكورة أعلاه وإصلاحها.