Instructor: Jump box, in the last lesson, 2 2
I introduced the concepts of zones 3 3
and I started talking about screened subnets. 4 4
In this lesson, I want to dig a little bit further into that 5 5
and then talk about how we can manage them. 6 6
So the first thing I had mentioned was 7 7
if you have an internet facing host. 8 8
Now I didn't really go into what that was, so let me take 9 9
a step here and go ahead and define it for you. 10 10
When I'm talking about something that's internet facing 11 11
like an internet facing host 12 12
or an internet facing server I'm talking about a host 13 13
or server that accepts inbound connections 14 14
from the internet. 15 15
So if I have a web server in my screened subnet 16 16
that is an internet facing host. 17 17
So you can see here again if I bring up my diagram, 18 18
I have my inside zone, my screened subnet 19 19
and my outside zone. 20 20
In that screened subnet, I have two internet facing hosts. 21 21
I have an email server and a web server. 22 22
Now, only the email and web servers that are 23 23
in the screened subnet are going to be able to get traffic 24 24
from the outside even though they haven't requested it. 25 25
So if you want to connect to my web server 26 26
you're going to go to diontraining.com 27 27
and it's going to go through my screened subnet 28 28
into my web server and then give you back your response. 29 29
Now, if you wanted to get to PC two or PC three 30 30
in my inside network you couldn't do that 31 31
because the firewall would block you. 32 32
Those are not internet facing. 33 33
They have access to the internet 34 34
but they're not facing the internet 35 35
meaning they are not open and waiting for a connection. 36 36
That's the difference when you're dealing 37 37
with internet facing hosts. 38 38
Now, anytime you have internet facing hosts 39 39
you want to place them into someplace secure 40 40
like your screened subnet. 41 41
Now your screened subnet is actually a segment 42 42
that is isolated from the rest of the private network by one 43 43
or more firewalls, and it's set up to accept connections 44 44
from the internet over designated ports. 45 45
Now, the reason we do this is we want to 46 46
keep all those forward facing servers 47 47
out of our internal network. 48 48
We don't want people 49 49
from the internet touching our internal network. 50 50
We only want them in our screened subnet. 51 51
This place that is kind of this semi-trusted zone. 52 52
And we know that anything that's behind the screened subnet, 53 53
such as my inside zone, 54 54
is actually invisible to the outside network. 55 55
So if you start scanning my network from the outside 56 56
you're not going to see all those PCs inside 57 57
of the inside zone. 58 58
Instead, you're only going to see the web server 59 59
and the email server 60 60
'cause those are forward facing and they're internet facing. 61 61
Now the next thing we need to talk about in terms 62 62
of the screened subnet is what kind 63 63
of stuff should you put in the screened subnet? 64 64
You could see here that I have my email 65 65
and my web server and the screened subnet. 66 66
Any other kind of communication servers, 67 67
proxy servers or remote access servers should also be 68 68
in the screened subnet. 69 69
Anything that somebody from the internet needs access 70 70
to should be placed in your screened subnet. 71 71
This is essentially anything that provides public services 72 72
or even extranet capabilities. 73 73
Any of your hosts that are in the screened subnet 74 74
we don't fully trust those even though there're our devices. 75 75
So we want to make sure that we harden them as best as we can. 76 76
And we have to remember that those devices 77 77
because they're forward facing, they could be touched 78 78
by an attacker, they could be compromised by an attacker. 79 79
So that's why they're not fully trusted 80 80
to our internal network 81 81
and that's why we actually have it go through the firewall. 82 82
Anything that's going from the screened subnet 83 83
to the inside and from the inside back 84 84
to the screened subnet. 85 85
That's another good place to put intrusion detection systems 86 86
to make sure that you're catching anything that may be going 87 87
from your screened subnet, because a common technique 88 88
for an attacker is to compromise something 89 89
in the screened subnet 90 90
and use that to pivot into your network. 91 91
So you want to protect yourself against that. 92 92
Now, any kind of host you put in the screened subnet 93 93
should really be what we consider a Bastion host. 94 94
This is a host or server that we put 95 95
into the screened subnet, which is not configured 96 96
with any services that run on the local network. 97 97
So I don't want to run something 98 98
like active directory inside the screened subnet, 99 99
that that's an internal network service. 100 100
Instead, I only want to run things that should be 101 101
in the internet. 102 102
Things like email, things like web, 103 103
things like remote access, those things can be hardened 104 104
and put into the screened subnet because we know 105 105
that they're going to be more vulnerable to attack. 106 106
Now when we want to configure our devices 107 107
inside the screened subnet, what you going to do? 108 108
Well, we're going to use something known as a jump box. 109 109
Now a jump box is a hardened server that provides access 110 110
to other hosts within the screened subnet. 111 111
So essentially we have this one server 112 112
and it is what can talk to the screened subnet 113 113
and we configure all the access control to make sure 114 114
that only the jump box can communicate 115 115
from the internal network to the screened subnet. 116 116
Now because of that 117 117
that jump box has to be heavily hardened. 118 118
It needs to be protected. 119 119
And what ends up happening is the administrator will connect 120 120
to the jump box and then the jump box will connect 121 121
to the host and the screened subnet. 122 122
Then I call it a jump box 123 123
'cause we're almost pivoting off of it. 124 124
We're going to connect from me to the jump box 125 125
and the jump box to the server I want to configure 126 126
and that's how we call it a jump box. 127 127
Now, this jump box can be a physical PC 128 128
or it can be a virtual machine. 129 129
Either one is fine. 130 130
A lot of people use virtual machines as a jump box 131 131
because you can have it hardened and secured. 132 132
You can use it for the time you need and then destroy it 133 133
and rebuild a new one because it's very quick 134 134
to rebuild an image from a virtual machine 135 135
if you already have a known good image. 136 136
And so a lot of people will do it that way. 137 137
Now, the jump box and the management workstation 138 138
that you're using to connect to that jump box 139 139
should have only the minimum required software to 140 140
perform their job and they should be well hardened. 141 141
Again, this is the one box that has the permissions 142 142
to go through the firewall 143 143
and touch the screened subnet from your internal network. 144 144
So you want to make sure it is well protected. 145 145
This is why you want to make sure that management workstation 146 146
and the jump box are fully hardened 147 147
and they have the least amount of software on 148 148
them to make sure they're fully hardened and fully secured.