Permit One Service, Not One Host

シナリオ

A security review found that the web servers can open any port on the application server, because the rule permitting the two to talk was written by address at a time when only one service was running. The application server now also hosts the database. Restrict the web tier to the application port only, without disturbing the administrators who legitimately need database access.

学習目標

• acl
• nftables
• port filtering
• least privilege

トポロジーと設定

この環境には4台のデバイス(3 Hosts, 1 Router)が含まれます。上記のネットワーキングスキルを設定し、トラブルシューティングします。

カリキュラムのトピック

• Network Security and Access Control / Filtering by Service

資格試験の出題範囲

• ccna-200-301 · 出題範囲5.6: Configure and verify access control lists
• comptia-network-plus-n10-009 · 出題範囲4.3: Given a scenario, apply network security features, defense techniques, and solutions