Replace an open management port with identity-based access

short · 45 min · Objective 4.5

Task

Take the most common posture finding there is -- a management port open to the world -- and walk it up the ladder of remedies to the one with no inbound port at all.

Steps

  1. Configure the host with its management port reachable from a broad source range, and record in lab/access.md what a posture check would say about it.
  2. Narrow the source to a single address and record what this does and does not fix -- specifically, what happens when your address changes and what it does not protect against.
  3. Introduce a bastion: management reachable only from one hardened host. Record the new exposure and the new maintenance burden.
  4. Move to agent-based session access: the host makes an OUTBOUND connection to a broker and has no listening management port at all. Confirm the port is closed while access still works.
  5. Add just-in-time elevation on top, and configure an alert on any administrative session. Record why an administrative login should be unusual enough to alert on in a well-automated estate.

Verify

grep -Eci 'bastion' lab/access.md
grep -Eci 'no (inbound|listening)|outbound' lab/access.md
grep -Eci 'just.in.time|jit|time-box' lab/access.md
grep -Eci 'alert' lab/access.md

All four rungs recorded. The final observation is worth writing down: if administrative logins are frequent enough that alerting on them is noisy, that is itself a finding about how much work is being done by hand.

This is an independent study companion for CompTIA Cloud+ CV0-004 and is not produced by or endorsed by CompTIA.