Security

Security covers host security administration, restricting access to services, and the encryption tasks an administrator does routinely: SSH keys, tunnels and GnuPG. Objective 110 of LPIC-1 Exam 102-500, worth 16.67% of the exam.

Share of the exam
16.67%
Questions in a real sitting
roughly 10 of 60
Questions in this bank
50
Signed for by a person
0
Machine-checked only
50

Partly checked. None of the 50 questions here has been read against the cited source by a person. 50 questions have been checked against their cited clause by an automated pass — which is not the same thing, and is not a signature.

Only questions a person has signed for are used in mock exams here. That is the whole difference between the two kinds of checking above.

How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.

What this objective covers

The 50 questions written for this objective cite 3 LPI exam objectives (110.1, 110.2, 110.3) and 19 manual pages (chage(1), fuser(1), gpg(1), gpg-agent(1), hosts_access(5), inittab(5), nmap(1), nologin(8), pwconv(8), shadow(5), ss(8), ssh(1), ssh-keygen(1), ssh_config(5), sshd(8), sudoers(5), systemctl(1), systemd.socket(5), xinetd.conf(5)).

They break down as 35 single-answer questions, 8 type-the-answer questions and 7 choose-several questions.

What this objective is really about

Practical hardening rather than theory. The recurring theme is that most controls block exactly one path and leave others open, and the exam repeatedly tests whether you know which path a given control actually covers.

Host security

Auditing setuid binaries uses find, and the -perm form matters. A bare mode is an exact match on all the permission bits, so -perm 4000 misses an ordinary setuid binary at 4755. A leading minus means "all these bits are set, others do not matter", so -perm -4000 is the one you want; a leading slash means "at least one of these bits".

Locking a password with passwd -l or usermod -L prefixes the stored hash so nothing can ever match it. That defeats password authentication and nothing else — an SSH key in authorized_keys still works. Actually blocking an account means expiring it with chage -E 0, removing the key, or setting the shell to nologin, and usually more than one.

/etc/nologin is a flag file: while it exists, non-root logins are refused and its contents are shown to the user turned away, which makes it the standard way to close a machine for maintenance. Do not confuse it with /sbin/nologin, a program you set as a service account's shell.

ulimit manipulates per-process resource limits, and each has a soft value that is enforced and a hard ceiling an unprivileged user can only lower. -n is open file descriptors, -u is user processes, -c is core dump size, -f is file size. Because a ulimit dies with its shell, permanent limits go in /etc/security/limits.conf.

For sudo, always edit sudoers with visudo — it locks against simultaneous edits and refuses to install a file that fails its syntax check, and a syntax error there can lock everyone out. Drop-in files under /etc/sudoers.d work because the main file includes that directory, but note that files whose names contain a dot are skipped, which quietly breaks anything named like webteam.conf. sudo -i is the login-shell form, mirroring su -; sudo -s is not.

Encryption in practice

For SSH keys, remember which file lives where. authorized_keys is on the server you log in to and lists the public keys allowed to authenticate as that account. known_hosts is on the client and records the host keys of servers already contacted, so the client can detect a changed or spoofed server. A private key never leaves the machine that generated it. sshd also checks permissions before accepting a key: ~/.ssh must be 700 and authorized_keys 600, owned by the user, and the home directory must not be group- or world-writable. When that check fails the client simply falls back to a password prompt, so the server log is the only place the reason appears.

Port forwarding has three forms. -L is local forwarding: ssh listens on your machine and the far end opens the connection, which is why "localhost" in the argument means the server's loopback, not yours. -R is the mirror image, listening on the remote side. -D creates a SOCKS proxy rather than a point-to-point forward.

ssh-agent holds decrypted keys in memory so a passphrase is typed once. ssh-add with no arguments loads the default keys, -l lists what the agent currently holds, and the agent is normally started with eval $(ssh-agent) so the SSH_AUTH_SOCK assignment takes effect in the current shell. The key file on disk is never modified by any of this.

For GnuPG, keep the two directions apart. To encrypt for someone you use their public key and they decrypt with their private key. To sign, you use your private key and anyone verifies with your public key. A revocation certificate should be generated at key creation time and stored safely, because it is what lets you withdraw a key you have lost control of.

Lessons in this objective

The objective cut into the pieces the blueprint declares. Each one has the material written out and the questions that test it.

Drill this objective

The trainer can run a short practice set drawn from this objective alone, which is what the weight column above is for: revise the heavy objectives first.

Practise Security

Questions on this objective (page 1 of 3)

Practise Security

The other objectives in LPIC-1 Exam 102-500