Keep private services private

Operational interfaces often reveal more power and data than the public application. Do not expose them merely because they have a login screen.

A database login page is still an exposed parser and authentication service. Every packet that reaches it exercises code that was never meant to face the open internet, before any password is checked.

Choose a private path

Use loopback, private networking, VPN access, provider firewalls, or an authenticated tunnel. The lightest option: bind the service to loopback and reach it over SSH when you need it:

ssh -L 5432:localhost:5432 [email protected]

While that tunnel is open, psql -h localhost -p 5432 on your laptop talks to the server’s PostgreSQL, wrapped inside your authenticated SSH session. Nothing new is exposed.

VPN or tunnel access adds operational dependency, but removes routine internet traffic from the interface.

Keep authentication on

Keep service authentication enabled even on private paths. The private network is one control and the password is another. You want both, because a mistake in either one should not be enough to open the data.

Check both firewall layers

Review cloud firewall and host firewall together so one layer does not create a false sense of safety. Test both network layers independently. The provider firewall limits paths before packets reach the host, while the host firewall protects against mistakes or traffic arriving through another interface.

From an external machine, prove the private port really is unreachable:

nc -vz 203.0.113.10 5432
# nc: connect to 203.0.113.10 port 5432 (tcp) failed: Connection refused

The recurring mistake: a dashboard exposed “for a quick demo” with ufw allow 8080, never removed. You recognize it by re-running the listener and firewall inventory on a schedule — an allow rule with no matching entry in your exposure map is a finding, not background noise.

Administer the lab database through loopback, a VPN, or an authenticated tunnel. Scan its public address and prove the database port is closed while local authentication still rejects a wrong password.