Day 5 - Week 10 Comprehensive Review: Tying Network Services Together on One Port Sheet

📌 Key Takeaways

• Every network service reduces to "on which port, which role's daemon, communicating in which direction."
• This week's four structures — mail is an asymmetry of sending/receiving, FTP has two channels, control and data, SSH is a single multipurpose tunnel on port 22, VNC/X is a reversal of who holds the screen.
• Ports to answer instantly: SMTP 25 · POP3 110 · IMAP 143 · FTP 21 (control) · 20 (active) · SSH/SFTP 22 · Telnet 23 · VNC 5900+N.
• Easily swapped pairs: POP3 (110/995) ↔ IMAP (143/993), SMTPS (465) ↔ submission (587), FTP 21 ↔ 20, SSH 22 ↔ Telnet 23.
• Troubleshooting narrows down in five steps — check LISTEN → daemon status → port reachability → firewall → logs.

Services and Ports Roundup — Memorize on One Table

A port number is an agreement about "which service this door is dedicated to." 25 is mail sending, 110 and 143 are mail receiving, 21 is FTP commands, 22 is SSH's multipurpose channel, 23 is plaintext Telnet. The encrypted ports (465, 587, 993, 995, 990) are variants of the plaintext ports with security added. You must be able to answer this mapping instantly to get through the practical exam.

⚠️ Trap Review: Easily swapped pairs — POP3 (110/995) and IMAP (143/993), SMTPS (465) and submission (587), FTP control (21) and active data (20), SSH (22) and Telnet (23). A choice that shifts these boundaries is wrong.

Mail Service Review — The Asymmetry of Sending and Receiving

Key distinction: MTA (server-to-server transfer) ≠ MDA (mailbox delivery) ≠ MUA (user client). Sending is one-way SMTP, and receiving is POP3/IMAP. Postfix's config is /etc/postfix/main.cf, and opening mynetworks too wide creates an open relay. POP3 = download then delete, IMAP = keep on server and sync is the key distinction.

FTP Review — Two Channels and Active/Passive

Active:  The client announces its port with PORT → the server (port 20) connects back to the client
Passive: The client requests PASV → the server opens a high port → the client connects

⚠️ Trap Review: In active mode the server connects back to the client (PORT, port 20), and in passive mode the client connects to the server (PASV, high port). A client behind NAT/a firewall needs passive mode. vsftpd's chroot_local_user locks users into their home, and ftpusers is the deny list. FTPS (FTP+TLS, 990) and SFTP (SSH-based, 22) are entirely different technologies.

SSH Review — The Multipurpose Secure Channel on Port 22

# Key security settings (sshd_config)
PermitRootLogin no              # Block direct root login
PasswordAuthentication no       # Keys only (apply after registering keys)
MaxAuthTries 3                  # Brute-force defense
 
# Key authentication: public key in the server's authorized_keys, private key on the client
ssh-keygen -t ed25519
ssh-copy-id user@host
 
# Forwarding
ssh -L 8080:internal:3306 user@gw   # Local: my side → beyond the remote
ssh -R 9090:localhost:80 user@gw    # Remote: remote side → my side
ssh -D 1080 user@gw                 # Dynamic: SOCKS proxy

Key distinction: Server config sshd_config (with the d) vs client config ssh_config. The public key (.pub) goes on the server, the private key on the client. ~/.ssh is 700, key files are 600. scp's port is uppercase -P, ssh's port is lowercase -p. You must distinguish the direction differences among forwarding -L (local), -R (remote), and -D (dynamic).

VNC and X Window Review — The Reversal of the Side Holding the Screen

VNC port = 5900 + display number (:1→5901). In X Window, the machine in front of the user that holds the screen and input devices is the X server, and the application that requests drawing is the X client (reversal). DISPLAY is the address of the screen to send the picture to, xhost controls per host and xauth per cookie, and xhost + (no argument) allows everything and is dangerous. A safe remote GUI is ssh -X.

Diagnostic Flow — The Order for Tracking Down Service Outages

ss -tlnp | grep :port      # 1. Is the service LISTENing on that port?
systemctl status service    # 2. Is the daemon alive?
telnet host port            # 3. Can the port be reached from outside? (firewall)
firewall-cmd --list-all     # 4. Has the firewall opened the port?
journalctl -u service       # 5. What errors are in the logs?

For server service outages, going through these five steps in order usually narrows down the cause — "is the daemon up, is it listening on the port, is the firewall blocking it, is the config correct, what do the logs say." If mail isn't going out, check mailq; if FTP is stuck, check active/passive and the firewall; if SSH is refused, check key permissions and PermitRootLogin; if the GUI doesn't come up, check DISPLAY and xhost. This week goes beyond the exam and is the foundation of real server operations.

📖 Glossary

• Port : An agreed-upon number that says "which service this door is dedicated to." It is the coordinate that identifies a service.
• MTA / MDA / MUA : Server-to-server transfer / final delivery to the mailbox / the client the user writes and reads with.
• Open relay : A state where mynetworks has been opened too wide, letting anyone relay mail. Abused for spam.
• POP3 vs IMAP : Download-and-delete-from-server / keep-on-server-and-sync (for multiple devices).
• FTP control/data channels : The port 21 connection over which commands travel / the separate connection over which files travel.
• Active (PORT) vs Passive (PASV) : The server connects back from port 20 / the client connects to a high port on the server (favorable for NAT).
• FTPS vs SFTP : FTP wrapped in TLS (990, two channels) / SSH-based file transfer (22, single channel).
• sshd_config vs ssh_config : Server (daemon) config / client config. The one with the d is the server.
• Public key authentication : The public key in the server's authorized_keys, the private key on the client. ~/.ssh 700, key files 600.
• Port forwarding -L/-R/-D : From my side beyond the remote / from the remote to my side / SOCKS proxy.
• VNC port formula : 5900 + display number. For :1 it's 5901.
• X server / X client : The machine in front of the user holding the screen and input devices / the application that requests drawing (reversal).
• DISPLAY : The address of the screen to which an X client sends its picture.
• xhost / xauth : Coarse access control per host (IP) / per-user authentication with a magic cookie.