Jumpbox.
In the last lesson,
I introduced the concept of zones
and started talking about DMZs.
In this lesson,
I want to dig a little bit further into that,
and then talk about how we can manage them.
So, the first thing I had mentioned was
if you have an Internet-facing Host.
Now, I didn't really go into what that was.
So, let me take a step here and go ahead
and define it for you.
When I'm talking about something that's Internet-facing,
like an Internet-facing Host
or an Internet-facing Server,
I'm talking about a host or server that accepts
inbound connections from the Internet.
So, if I have a web server in my DMZ,
that is an Internet-facing Host.
So, you can see here again,
if I bring up my diagram,
I have my inside zone,
my DMZ, and my outside zone.
In that DMZ,
I have two Internet-Facing Hosts.
I have an Email server and a Web server.
Now, only the Email and Web servers that are
in the DMZ are going to be able
to get traffic from the outside,
even though they haven't requested it.
So, if you want to connect to my web server,
you're going to go to diontraining.com
and it's going to go through my DMZ
into my web server
and then give you back your response.
Now, if you wanted to get
to PC two or PC three in my inside network,
you couldn't do that,
because the firewall would block you.
Those are not Internet-Facing.
They have access to the Internet,
but they are not facing the Internet,
meaning they are not open
and waiting for a connection.
That's the difference when you're dealing with
Internet-facing hosts.
Now, anytime you have
Internet-facing hosts,
you want to place them into
some place secure like your DMZ.
Now, your DMZ is actually a segment that is isolated
from the rest of the private network
by one or more firewalls.
And it's set up to accept connections from the Internet
over designated ports.
Now, the reason we do this is we want to keep
all those forward facing servers
out of our internal network.
We don't want people from the Internet
touching our internal network,
we only want them in our DMZ.
And that's why we have this DMZ.
It's this place that is kind of
this semi-trusted zone.
And we know that anything
that's behind the DMZ,
such as my inside zone, is actually invisible
to the outside network.
So, if you started scanning my network
from the outside,
you're not going to see all those PCs inside
of the inside zone.
Instead, you're only going to see the web server
and the email server
cause those are forward-facing
and they are Internet-facing.
Now, the next thing we need to talk about
in terms of the DMZ is what kind
of stuff should you put in the DMZ.
You can see here that I have my Email
and my Web server in the DMZ.
But any other kind
of communication servers,
proxy servers, or remote access servers
should also be in the DMZ.
Anything that somebody from the Internet needs access to,
should be placed in your DMZ.
This is essentially anything that provides public services
or even extranet capabilities.
Any of your hosts that are in the DMZ,
we don't fully trust those,
even though there are devices.
So, we want to make sure that we harden them
as best as we can.
And we have to remember that those devices,
because they're forward facing,
they could be touched by an attacker,
they could be compromised by an attacker.
So, that's why they're not fully trusted
to our internal network.
And that's why
we actually have it go through the firewall,
anything that's going from the DMZ to the inside
and from the inside back to the DMZ.
That's another good place to put intrusion detection systems
to make sure that you're catching anything
that may be going from your DMZ
because a common technique for the attacker
is to compromise something in the DMZ
and then use that to pivot into your network.
So, you want to protect yourself against that.
Now, any kind of hosts you put in the DMZ
should really be what we consider a Bastion Host.
This is a host or server
that we put into the DMZ,
which is not configured with any services
that run on the local network.
So, I don't want to run something like Active Directory
inside the DMZ.
That's an internal network service.
Instead, I only want to run things that should be
in the Internet,
things like email,
things like web,
things like remote access.
Those things can be hardened and put into the DMZ
because we know
that they're going to be more vulnerable to attack.
Now when we want to configure our devices
inside the DMZ,
what are we going to do?
Well, we're going to use something known as a jumpbox.
Now, a jumpbox is a hardened server
that provides access to other hosts
within the DMZ.
So essentially, we have this one server
and it is what can talk to the DMZ
and we can figure all the access control
to make sure that only the jumpbox
can communicate from the internal network
to the DMZ.
Now, because of that,
that jumpbox has to be heavily hardened,
it needs to be protected.
And what ends up happening is
the administrator will connect to the jumpbox,
and then the jumpbox will connect to the host
in the DMZ.
So, we call it a jumpbox cause we're almost
pivoting off of it.
We're going to connect from me
to the jumpbox and the jumpbox
to the server I want to configure.
And that's why we call it a jumpbox.
Now, this jumpbox can be a physical PC
or it can be a virtual machine,
either one is fine.
A lot of people use virtual machines
as a jumpbox because
you can have it hardened and secured,
you can use it for the time you need,
and then destroy it and rebuild a new one
because it's very quick to rebuild an image
from a virtual machine
if you already have a known good image.
And so a lot of people will do it that way.
Now, the jumpbox and the management workstation
that you're using to connect to that jumpbox
should have only the minimum required software
to perform their job
and they should be well-hardened.
Again, this is the one box that has the permissions
to go through the firewall and touch the DMZ
from your internal network.
So, you want to make sure it is well-protected.
This is why you want to make sure
that management workstation
and the jumpbox are fully hardened
and they have the least amount of software on them
to make sure they are fully hardened
and fully secured.