Server Hardening and Secure Configuration

Server hardening means making a server less vulnerable to attack by systematically reducing its attack surface. The attack surface is the total number of ways an attacker can interact with the server — every open port, running service, active account, and enabled protocol is a potential entry point.

Why disable unnecessary services? Each service that runs on a server adds code, opens network ports, and listens for connections. A service like the print spooler might be essential for a print server but completely useless on a web server. Leaving it running is dangerous: if a vulnerability is discovered in that service, an attacker could exploit it to gain access. By disabling it, you eliminate that risk entirely. The principle is called “least functionality” — a server should only have the services it actually needs.

Examples of common services to disable include: Telnet (insecure remote access), FTP (insecure file transfer), NetBIOS over TCP/IP (old file sharing protocol), the print spooler (if no printer is connected), and the Remote Desktop service (if remote desktop is not used). On Windows, you can disable services via the Services console (services.msc) or using PowerShell (Set-Service). On Linux, you use systemctl (systemctl disable servicename). Remember, disabling a service prevents it from starting at boot; stopping a service only halts it until the next reboot.

Why use secure protocols? Protocols define how clients and servers communicate. Insecure protocols like Telnet and FTP send data in plain text, meaning any attacker on the network can read login credentials, files, and commands. Secure protocols encrypt the communication, protecting confidentiality and integrity. For remote shell access, replace Telnet with SSH (Secure Shell, port 22). For file transfer, replace FTP with SFTP (SSH File Transfer Protocol, also port 22) or FTPS (FTP over SSL/TLS). For web traffic, use HTTPS (HTTP over TLS, port 443) instead of plain HTTP (port 80). Encryption uses certificates and cryptographic keys to scramble data so only authorised parties can read it.

Another key technique is changing default credentials. Most server operating systems come with built-in accounts like Administrator (Windows) or root (Linux). Attackers know these default usernames and often try common passwords. Hardening requires renaming or disabling these accounts, and setting strong, unique passwords for all accounts. The principle of least privilege applies here: give each account only the permissions it needs, nothing more.

Patch management is also part of hardening. Vendors regularly release updates to fix security flaws. Applying these patches closes known vulnerabilities. Hardening is not a one-time task; it requires ongoing monitoring and updates.

Finally, logging and monitoring are essential. After hardening, you still need to watch for suspicious activity. Enable audit logs (e.g., Windows Event Log, syslog on Linux) and send them to a central log server. This helps detect if an attacker bypasses your hardening efforts.

In summary, server hardening is a layered approach: disable what you don’t need, encrypt what you do, secure accounts, patch often, and watch everything. On the SK0-005 exam, you’ll need to identify which services to disable and which protocols to use in given scenarios.

Imagine you’re a junior administrator at a company called DataVault. The company is deploying a new application server that will host a customer database. Your task is to harden it before it goes live.

You start with a fresh installation of Windows Server 2022. You choose the Server Core installation option because it has no graphical user interface, reducing the attack surface and resource usage. Next, you open the Services console. You see dozens of services running. You know the server only needs to run a database (SQL Server) and have remote management via SSH. You systematically disable:

For each service, you set the startup type to “Disabled”, not just “Stopped”, so they never start again.

You then change the Administrator account password to a complex, 20-character passphrase. You also create a new local account with limited permissions for day-to-day monitoring, and disable the built-in Guest account.

Now you turn to protocols. The web interface for the database must use HTTPS. You install a TLS certificate from the company’s internal certificate authority. You configure the web server to only accept TLS 1.2 and 1.3, disabling older, insecure versions like SSL 3.0 and TLS 1.0. You also disable HTTP altogether (port 80).

For remote management, you install an SSH server (OpenSSH for Windows) and ensure Telnet is not installed. You configure SSH to allow only key-based authentication, not passwords.

You configure the Windows Firewall to allow inbound traffic only on port 443 (HTTPS) and port 22 (SSH), and block all other ports. You also enable logging to forward events to a central Security Information and Event Management (SIEM) system.

Finally, you run a vulnerability scanner (like Nessus) to verify no unnecessary ports are open and no weak protocols are enabled. The scan comes back clean.

This real-world process demonstrates the exact steps an IT professional follows. The SK0-005 exam expects you to know the why and how behind each action, and to apply them in scenario-based multiple-choice questions.