Network › Module 4 › Lesson 3
What Must Never Sit in the DMZ
A never-list beats a yellow box — then keep secrets off
Visual · never_in_dmz
IdP, backups, domain admin do not live in the front room. http://192.168.0.1/ YOUR lab. Public 8783 vs app 8793.
Opening
If the box strangers can knock on also prints payroll, the diagram lied.
Lessons 1–2 named the front room and the admin hop. This lesson is the never-list: identity providers, backup catalogs, HSMs, domain controllers, CI secrets, and admin workstations do not belong on the public dest. They fail open in the worst way — one RCE on the porch becomes every key in the house. Your cartoon: do not put “secret” in the toy; keep it on and still bind loopback. Original Cyberlium.
1. Write the never-list before the lab starts listeners
Never in the public role: password hashes, backup roots, Kubernetes etcd, IdP signing keys, domain admin workstations, your only jump credential store. If a vendor appliance “must be in the DMZ,” demand which secrets it holds. Many “DMZ” appliances are just interior brains with a public NIC.
. Do not put the never-list into a home gateway as firewall comments you cannot export. Keep it under cyberlium-lab chmod 600.
2. Refuse to serve secrets from the public dest
A one-liner check: if the process bound to 8783 can read the app secret file, your rooms leaked. Keep secret notes in a file that the public toy is not told to open. 8793 may greet as “app” without dumping keys.
Do not “test the never-list” by putting real passwords in either toy. Do not fetch cloud metadata. Do not sqlmap a live IdP.
Command guide
Refuse to serve secrets from the public dest
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
python3 - << 'PY'
from pathlib import Path
public_port = 8783
secret = Path.home() / "cyberlium-lab" / "t11-m04-app-secret.note"
secret.write_text("toy_secret=not_for_public_listener
", encoding="utf-8")
print("secret_path", secret)
print("public_port", public_port, "must_not_open_secret_file")
print("app_port", 8793, "is_the_interior_cartoon")
PYCommand — copy this
curl -sS -m 2 "http://127.0.0.1:8783/" | tee "$HOME/cyberlium-lab/t11-m04-public-check.body" grep -i "toy_secret" "$HOME/cyberlium-lab/t11-m04-public-check.body" && echo "FAIL: public leaked dummy secret"
3. Diagrams that park everything in one yellow box
Slide-ware DMZs fail by inclusion: “and the SIEM, and the update server, and the jump, and Git.” Each extra role expands the exposure budget until it is the company. Cut roles until public is boring.
Record the never-list. Next lab starts 8783 public and 8793 app, both 127.0.0.1. Still no 0.0.0.0, no WAN DMZ checkbox, no nmap.
Command guide
Diagrams that park everything in one yellow box
═══ COMMANDS ═══
Command — copy this
grep -c "never_on_public_8783" "$HOME/cyberlium-lab/t11-m04-never.txt"
4. What you ship: a never-list and a public dest that does not read app secrets
t11-m04-never.txt exists. Dummy secret is not served on 8783. DEMO GATE. No real passwords in toys. No WAN forwards. No 0.0.0.0.
5. What you record before the next lesson
Date. Never-list rows. Public 8783 vs app 8793. DEMO identified/STOP. NEVER nmap/sqlmap/0.0.0.0. File t11-m04-l03-never-in-dmz.txt chmod 600.
6. Wrong vs right: stranger networks vs literacy on systems you own
Worked failure — same network word, opposite target. Right never needs a café or campus LAN.
Wrong
Put IdP + backups + WordPress on one public VM. Enable router DMZ host. sqlmap the campus SSO.
Right
Keep secrets off 8783. Write the never-list. Next: Lab — Public vs App Listener on Loopback.
Mission: keep the porch boring
1) / STOP if router. 2) Write ≥3 never_on_public rows. 3) Confirm a dummy secret is not in a 8783 body (or that 8783 is down). No real secrets. No WAN DMZ.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor which roles expand exposure budget — not how to hide an IdP on a home WAN port.
Knowledge Check
APPLY: A slide puts Git, IdP, and the public website on one “DMZ VLAN.” What do you flag?
Multiple choice
Knowledge Check
APPLY: True or False: The public cartoon listener on should read t11-m04-app-secret.note and print it.
True or False
Knowledge Check
APPLY: curl http://192.168.0.1/ is TP-Link Router Admin. You planned to “put the never-list in firewall comments.” You:
Multiple choice