Security Hardening for Legacy Networks
In this lesson, you will learn how to apply Mandatory Access Control (MAC) to restrict services that rely on unencrypted, legacy network protocols, effectively creating a "security bubble" around vulnerable applications.
Many legacy networks rely on clear-text protocols like Telnet, FTP, or unencrypted HTTP/RPC. Because these protocols transmit data—including credentials—in the open, they are inherently insecure. While the ideal solution is to replace them, legacy constraints often force us to keep them running. We can harden these services by using MAC frameworks (such as SELinux or AppArmor) to enforce the principle of least privilege, ensuring that even if a service is compromised via its insecure network connection, the attacker cannot pivot to the rest of the system.
Containing Insecure Services
The core idea is to confine the service process to a strictly defined security context. By explicitly limiting what files the service can read, write, or execute, we negate the impact of an exploit. If a legacy FTP server is compromised, the MAC policy should prevent the process from accessing /etc/shadow or executing system binaries like ssh or iptables.
For example, if you are using SELinux, you can create a targeted policy to restrict a legacy service’s network access:
# Define a confined domain for your legacy service
type legacy_service_t;
type legacy_service_exec_t;
# Allow access only to specific configuration files
allow legacy_service_t legacy_conf_t:file { read open getattr };
# Explicitly deny access to sensitive system directories
dontaudit legacy_service_t shadow_t:file { read write };
By binding the process to legacy_service_t, you ensure that the process can only perform the specific tasks required for its function. If the process attempts to "break out" of its assigned context to probe the network or modify system files, the kernel blocks the action and logs a denial, providing you with a critical audit trail. This effectively turns an insecure, "naked" protocol into a contained, high-monitored application that poses a significantly reduced risk to your infrastructure.
Key Takeaway: By applying strict Mandatory Access Control policies to legacy services, you can isolate unencrypted network processes and prevent them from becoming lateral movement vectors for attackers.