Network exposure
Inventory listening services
Find which processes listen on which interfaces and decide whether each port should be public, private, or local-only.
8 minute lesson
A firewall rule is easier to reason about when we know what is actually listening. Start from the process and interface.
Use ss to inspect TCP and UDP listeners, then map each socket to its service and owner. A database used only by the local application should bind to loopback or a private network. Remove services the server does not need.
sudo ss -lntupPostgreSQL on 0.0.0.0:5432 is reachable through every server interface even if the app uses localhost. A firewall may hide it today, but binding it narrowly removes another exposure path.
Capture UDP listeners and container-published ports too. A service may not appear in the expected application configuration while Docker or a socket-activated unit still exposes it.
Save listener output with process, owner, address, port, and purpose. Stop or rebind one unnecessary listener, then verify locally and from an external host that only intended paths work.
Lesson completed