Question

During a hardening review of a production PostgreSQL database server, a SOC analyst discovers the host is also running an active SMTP relay, an FTP daemon, and the SNMP service with the default 'public' community string. The database application only requires inbound TCP 5432 from the application tier and outbound access to a patch repository. Following the principle of least functionality, which recommendation should the analyst make?

Accepted Answer

Disable and remove the SMTP relay, FTP daemon, and SNMP service, since none are required by the database role and each expands the attack surface

Answer

Leave SNMP running but change the community string, and keep FTP for transferring database backups more efficiently

Answer

Keep all services running and rely on host-based firewall rules to restrict which subnets can reach each service

Answer

Migrate the SMTP and FTP services to non-standard high ports to obscure them from automated scanners