Lion Cipher Lab
Check listening ports against an approved port register
- Cyber / Security Engineer
- Intermediate
- ~35 min
- Free · no account required
Why it matters
Every listening network service is attack surface. Hardening guidance has said the same thing for decades: run only the services a system needs, and make each one reachable only from where it needs to be. CIS Control 4 includes uninstalling or disabling unnecessary services, and NIST SP 800-123, the server security guide, tells administrators to remove or disable services that are not required. In practice, hosts drift. A developer starts a Java service on 8080 to test something. A database gets reconfigured to listen on all interfaces 'temporarily'. A decommissioned service's approval stays…
What you'll learn
- listing listening sockets with ss
- why the bind address matters as much as the port
- keeping an approved port register per host
- finding unregistered, over-exposed and stale entries
- loopback is a range, not one address
- fixing over-exposed services at the service, not just the firewall
- making the register a living control
Steps in this lab
- Ports, bind addresses and the register
- Collect the sockets with ss
- Write the register check
- Run it and fix what it finds
- Make the register a living control