0

I have several servers that must be exclusively accessible only on the internal network, for example database, which can never be accessible via internet. And also cases that they can only be accessed by specific IPs, for example, access via SSH that should only be by authorized IPs.

As I'm a little paranoid, I'm afraid that because of some human or network failure, my firewall fails and these servers are exposed to anyone on the internet.

Is there any way to actively monitor a list of public IPs and certain ports for them, and if one of those ports is reachable from the internet, I get an alert?

E.g. A sysadmin at the company removed the firewall on Elasticsearch port 9200 and anyone can now access it over the internet. This way I receive an alert so that this failure is corrected as soon as possible.

1
  • You might want to consider using a port monitoring service. These types of services generally monitor open ports, whereby the service will try to connect to a server:port at regular intervals, and alert you if a connection cannot be made. However, there are some port monitoring services that monitor closed ports as well, and will alert you if it is able to connect to a server:port that should be closed.
    – mti2935
    Commented Jun 28, 2023 at 16:53

3 Answers 3

1

There are many tools that can do this for you. Shodan can allow you to search your own domain. Services like SecurityScorecard can be set up with alerts for changes like you mention.

1
  • @achillean please don't advertise in comments.
    – schroeder
    Commented Jul 6, 2023 at 9:06
1

As I'm a little paranoid, I'm afraid that because of some human or network failure, my firewall fails and these servers are exposed to anyone on the internet.

This does not happen for almost everyone. If your server have a "internal network", it probably don't have a public addressable IP. It should have a local IP (192.168.x.x or 10.x.x.x or 172.16.x.x) and nobody can connect to them straight from the internet.

To someone have access direct to the server, your sysadmin will have to create a port forward on your gateway redirecting traffic from port 9200 on the gateway to port 9200 on your server. So a firewall issue would remove access from your server, not add access.

If even that isn't enough, you can enable firewall on the server itself: block anything that isn't from the local network. That will not help much because you should not have any extraneous traffic hitting the server unless the sysadmin created a port forward rule by mistake.

For SSH, you can do the same: configure your firewall to accept connections only from local network and from specific IP addresses.

E.g. A sysadmin at the company removed the firewall on Elasticsearch port 9200 and anyone can now access it over the internet. This way I receive an alert so that this failure is corrected as soon as possible.

That's not what usually happens when an ElasticSearch database leaks. Usually the ElasticSearch instance is running on a cloud provider with a public IP, and the admin forgot to add a firewall or VPN, let it listen to the whole internet, and didn't even protected it with a password. Or had a bad password. Or had a very good password but the password was on a Javascript file embedded on a test site somewhere.

1
  1. Spin up a cheap VPC outside your organisation for as little as $5 per month.
  2. Write or have someone write a simple Python script that invokes nmap, or just uses python-nmap to scan your IP and port ranges.
  3. Have an API key installed in the scripts that messages you on Slack or whatever when something that differs from what should be found shows up.
  4. Set the script to run in cron for every 5 minutes or so.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .