🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Technology & Design › Cybersecurity › Security Operations: Monitoring, Defense, and Controls › Lesson 7
TEC-CYBE44-03 · Lesson 7 · 13 clock hours · lab

Secure Network Protocols and Protocol Hardening

Objective. Students will replace or disable insecure protocols on a lab system and verify that only approved secure protocols are in use, documenting the before-and-after configuration.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by an industry-certified professional or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

Why Protocol Choice Is a Security Decision

Every time two systems communicate, they use a protocol — an agreed set of rules for formatting and exchanging data. Some protocols were designed decades ago, before network attacks were common, and they transmit data including usernames and passwords in cleartext. Anyone on the same network segment who runs a packet capture can read that data instantly. Replacing or disabling those legacy protocols is one of the most impactful and straightforward hardening steps a security operations technician can take.

Insecure Protocols You Must Know

Telnet (TCP port 23) provides remote command-line access to a device but sends every keystroke — including login credentials — as unencrypted plaintext. A passive Wireshark capture will display the username and password in full.

FTP (TCP ports 20 and 21) transfers files but likewise sends credentials and file contents in cleartext. Even if authentication succeeds over an encrypted channel, classic FTP does not protect the data channel.

SNMPv1 and SNMPv2c manage network devices using a shared "community string" that functions as a password. Both versions send that community string in cleartext and have weak or no authentication. SNMPv2c adds bulk data retrieval but does not fix the authentication problem.

HTTP (TCP port 80), TFTP (UDP port 69), and rsh/rlogin are additional cleartext protocols you will encounter in practice, though this lab focuses on the three above.

Secure Replacements

SSH (TCP port 22) — Secure Shell — replaces Telnet and rlogin. It encrypts the entire session, authenticates the server using public-key cryptography so clients can detect impersonation, and supports key-based authentication to eliminate password guessing. OpenSSH is the standard implementation on Linux.

SFTP and FTPS replace FTP. SFTP runs file transfers inside an SSH session. FTPS wraps FTP in TLS. Either eliminates the cleartext credential and data exposure of classic FTP.

SNMPv3 replaces SNMPv1/v2c. It adds three security features: authentication (verifies the sender using HMAC-MD5 or HMAC-SHA), privacy (encrypts the payload with AES or DES — AES is preferred), and access control (View-Based Access Control Model, VACM). Configuring SNMPv3 with both authentication and privacy (the "authPriv" security level) is the current best practice.

How to Harden a Linux Server: The Process

Step 1 — Baseline scan. Before making changes, run `nmap -sV <server-IP>` to document which services and versions are listening. Save the output. This is your "before" state.

Step 2 — Capture traffic. While Telnet and FTP are still running, open Wireshark on the lab network interface and capture a Telnet login session. Observe the cleartext credentials. This evidence justifies and documents the risk.

Step 3 — Disable insecure services. On a systemd-based Linux system:

Step 4 — Enable and configure secure services.

Step 5 — Verify. Run `nmap -sV <server-IP>` again. The output should show port 22 (SSH) open and ports 21, 23, and 161 (UDP) either closed or filtered. This is your "after" state.

Step 6 — Capture again. Capture an SSH session in Wireshark. The payload will appear as encrypted binary, confirming no cleartext is transmitted.

Documenting Your Work: The Hardening Checklist

A hardening checklist is a professional deliverable used by security teams to track configuration changes, ensure repeatability, and satisfy audit requirements. For each change, record: (1) the item changed, (2) the security reason, (3) the command or setting used, and (4) how you verified the change. This document supports both internal governance and external compliance reviews such as those referenced in frameworks like NIST SP 800-53 and CIS Benchmarks.

Safety and Lab Conduct

All work in this course takes place on isolated lab virtual machines only. Never scan or modify systems outside your assigned lab environment — doing so without authorization may violate the Computer Fraud and Abuse Act (CFAA). Treat lab credentials as you would production credentials: do not share them, and change any default passwords before beginning hardening exercises. If a lab VM is shared, coordinate with your instructor before stopping services so other students are not affected.

Connection to Industry Credentials

CompTIA Security+ and CySA+ both test knowledge of secure versus insecure protocols and the ability to recommend protocol replacements. ISC2 CC covers the same concepts under its network security domain. Employers expect entry-level security operations technicians to perform exactly the tasks in this lab as part of routine system hardening and vulnerability remediation.

Key terms9

CleartextData transmitted across a network in human-readable, unencrypted form, making it visible to anyone capturing packets on the same network segment.
TelnetA legacy remote-access protocol that operates on TCP port 23 and transmits all session data, including credentials, in cleartext.
SSH (Secure Shell)A cryptographic network protocol on TCP port 22 that provides encrypted remote command-line access and file transfer, replacing Telnet and rlogin.
SNMPv3The current version of the Simple Network Management Protocol, which adds authentication, payload encryption (privacy), and access control to correct the security weaknesses of SNMPv1 and SNMPv2c.
Protocol hardeningThe process of replacing, disabling, or reconfiguring network protocols to eliminate insecure options and reduce the attack surface of a system or network.
NmapAn open-source network scanning tool used to discover hosts and identify open ports and running services on a target system.
WiresharkAn open-source packet capture and analysis tool that displays the contents of network traffic in detail, useful for demonstrating cleartext versus encrypted protocols.
authPrivThe SNMPv3 security level that enables both authentication (verifying the sender) and privacy (encrypting the message payload), providing the strongest protection available in SNMPv3.
Attack surfaceThe total set of points on a system where an unauthorized user could attempt to enter, extract data, or cause harm; disabling unnecessary services reduces the attack surface.
In class: Use Wireshark to capture and compare traffic from Telnet and SSH sessions side by side, annotating the capture to show cleartext credentials in Telnet versus encrypted data in SSH. · On a lab Linux server, disable Telnet, FTP, and SNMPv1/v2, enable SSH and SNMPv3, then run an Nmap service scan to confirm only approved services are listening. · Produce a one-page protocol hardening checklist for the lab server, documenting each change made, the security reason for the change, and the verification method used.
Materials: Linux VM with Telnet, FTP, and SNMP services pre-installed for the exercise, Wireshark, Nmap, SSH client, lab guide.
Check: Wireshark annotation correctly identifies cleartext credentials; Nmap output confirms only secure services are running; hardening checklist is complete and accurate; lab report scored at 75% or higher.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

Network Security / Secure Protocols
1. A technician captures network traffic during a Telnet login session. Which of the following will the technician most likely observe in the packet capture?
Security Operations / System Hardening
2. Which command on a systemd-based Linux system both stops the FTP service immediately AND prevents it from starting automatically after a reboot?
Security Operations / Verification
3. An administrator wants to verify that Telnet and FTP are no longer listening after hardening a server. Which tool provides the most direct confirmation?
Network Security / SNMP
4. Which SNMPv3 security level provides BOTH authentication and encryption of the message payload?
Security Controls / Access Management
5. A student edits /etc/ssh/sshd_config and sets PermitRootLogin no. What is the PRIMARY security benefit of this setting?
Network Security / Protocol Analysis
6. When comparing a Wireshark capture of an SSH session to one of a Telnet session, which difference will the analyst observe in the SSH capture?
Security Operations / Documentation
7. A hardening checklist entry reads: 'Change: Disabled SNMPv1/v2c. Reason: Community strings sent in cleartext. Verification: ____.' Which verification method BEST completes this entry?
Governance, Risk, and Compliance / Documentation
8. A technician is hardening a Linux server for a client whose compliance framework references the CIS Benchmarks. After disabling Telnet and FTP and enabling SSH, which action BEST demonstrates due diligence before closing the change ticket?
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
← Previous lessonProgram planNext lesson →