exposed-services/remote-management.yaml at main · sensorfleet/exposed-services · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
# service-id:         # A unique ID (inside this file) for the service
#   name: Service X   # A human-readable name for the service
#   ports:            # A list of ports or port ranges that the service uses
#     - 6666          # A single port as a number or a string
#     - "7777"
#     - "8888-9999"   # A port range
#   description: >
#     A description that explains what the service
#     is and why exposing it might not be ideal.
#     Additionally give some ideas to remedy the
#     situation: https://www.youtube.com/watch?v=dQw4w9WgXcQ

ssh:
  name: SSH
  ports:
    - 22
  description: >
    SSH is typically used to log into a remote machine and execute commands, but
    it also supports tunneling, forwarding TCP ports and X11 connections; it can
    transfer files using the associated SSH file transfer (SFTP) or secure copy
    (SCP) protocols. https://en.wikipedia.org/wiki/Secure_Shell#Usage

telnet:
  name: Telnet
  ports:
    - 23
  description: >
    Telnet, by default, does not encrypt any data sent over the connection,
    including passwords. https://en.wikipedia.org/wiki/Telnet#Security

rcp:
  name: RSH
  ports:
    - 513-514
  description: >
    Remote Shell (RSH) and Remote Copy (RCP) port. Also used by several
    malwares.

rpc:
  name: Windows RPC over HTTP and HTTPS
  ports:
    - 593-594
  description: >
    Windows RPC over HTTP and HTTPS

rdp:
  name: RDP
  ports:
    - 3389
  description: >
    "Although Remote Desktop Services (RDS) can be a fast way to enable remote
    access for employees, there are a number of security challenges that need to
    be considered before using this as a remote access strategy." Security
    guidance for remote desktop adoption,
    https://www.microsoft.com/security/blog/2020/04/16/security-guidance-remote-desktop-adoption/

vnc:
  name: VNC
  ports:
    - 5800-5805
    - 5900-5905
  description: >
    "By default, RFB is not a secure protocol. While passwords are not sent in
    plain-text (as in telnet), cracking could prove successful if both the
    encryption key and encoded password were sniffed from a network. For this
    reason it is recommended that a password of at least 8 characters be used."
    https://en.wikipedia.org/wiki/Virtual_Network_Computing#Security

docker:
  name: Docker daemon
  ports:
    - 2375-2376
  description: >
    Remote communication with Docker daemon. Port 2375 is un-encrypted by
    default.

x:
  name: X Window System
  ports:
    - 6000-6005
  description: >
    X Window System

#
# Firewalls
#

fortinet:
  name: Fortinet FortiGate firewall
  ports:
    - 541
  description: >
    Management port of Fortinet FortiGate firewall.