LPIC-2 System Security — Timed 10 Questions

Question 1

A system administrator notices that the SSH service on a Linux server is failing to start. The log shows: 'sshd: error: Could not load host key: /etc/ssh/ssh_host_rsa_key'. What is the most likely cause and solution?

Accepted Answer

The host key file is missing or corrupt. Run 'ssh-keygen -A' to regenerate all missing host keys.. The error message indicates that the SSH daemon cannot load the RSA host key file. Host keys are generated during package installation or manually via ssh-keygen. Option D is correct because running 'ssh-keygen -A' automatically generates all missing host key types (RSA, ECDSA, Ed25519) that are configured for use, resolving the missing or corrupt key issue without manual intervention.

Answer

The sshd_config file has a syntax error. Run 'sshd -t' to check it.

Answer

The SSH service is managed by xinetd and the configuration is missing. Edit /etc/xinetd.d/ssh.

Answer

The /etc/ssh/sshd_config file has incorrect permissions. Change them to 600.

Question 2

A security policy requires that all users must change their passwords every 90 days. Which command enforces maximum password age for an existing user 'jdoe'?

Accepted Answer

chage -M 90 jdoe. The `chage -M 90 jdoe` command sets the maximum number of days a password is valid for user 'jdoe' to 90 days, enforcing the security policy. The `-M` option directly controls the password aging parameter that defines when the password must be changed, as stored in `/etc/shadow`.

Answer

passwd -f jdoe

Answer

usermod -e 90 jdoe

Answer

chage -E 90 jdoe

Question 3

A security audit reveals that the /var/log directory contains world-readable log files that may contain sensitive information. The administrator wants to ensure new files created in /var/log are not readable by others, without affecting existing file permissions. Which umask value should be set system-wide?

Accepted Answer

umask 026. Option D (umask 026) is correct because it sets the default permissions for new files to 640 (rw-r-----), which removes read access for 'others' while preserving read access for group members. The umask value is subtracted from the base permissions (666 for files), so a umask of 026 results in 666 - 026 = 640, meeting the requirement that new files in /var/log are not world-readable without altering existing file permissions.

Answer

umask 027

Answer

umask 022

Answer

umask 077

Question 4

Which TWO commands can be used to display the current iptables rules for the filter table?

Accepted Answer

iptables -L. Option A is correct because `iptables -L` lists the current rules in the default filter table without needing to specify the table explicitly. Option C is correct because `iptables -t filter -L` explicitly selects the filter table and lists its rules, which is functionally equivalent to the default behavior of `iptables -L`.

Answer

iptables -S

Answer

iptables -t nat -L

Answer

iptables -t mangle -L

Question 5

Which THREE of the following are valid methods to restrict access to the su command on a Linux system?

Accepted Answer

Edit the /etc/suauth file to specify allowed users.. Option D is correct because the /etc/suauth file (used by some Linux distributions with the 'su' command from the 'shadow' suite) allows you to specify which users or groups are permitted to use su, providing a direct access control mechanism. Option E is correct because configuring pam_wheel.so in /etc/pam.d/su with the 'wheel' group restricts su access to only members of that group, a standard PAM-based method.

Answer

Set the SU_WHEEL_ONLY variable in /etc/login.defs.

Answer

Modify /etc/shells to include only approved shells.

Answer

Configure sudoers to allow only specific users to run su.

Question 6

Based on the iptables output, what is the expected behavior for incoming SSH connections on eth0?

Accepted Answer

SSH connections from any source to port 22 on eth0 are allowed if they are new.. The iptables output shows a rule on the INPUT chain for eth0 that accepts TCP packets destined for port 22 (SSH) with the state NEW. This means that any incoming SSH connection attempt (SYN packet) that is not part of an existing connection is explicitly allowed. The default policy for the INPUT chain is ACCEPT (not shown as DROP), so even without this rule, SSH would be allowed, but the rule ensures it is explicitly permitted for new connections.

Answer

SSH connections are only allowed if they are part of an established connection.

Answer

SSH connections are dropped because the default policy is DROP.

Answer

SSH connections are only allowed from the loopback interface.

Question 7

Based on the sshd configuration, user 'charlie' attempts to log in using public key authentication. What will happen?

Accepted Answer

Login is denied because the DenyUsers directive explicitly blocks charlie.. The DenyUsers directive in sshd_config explicitly blocks the user 'charlie' from logging in, regardless of the authentication method. Since DenyUsers takes precedence over AllowUsers and other authentication settings, public key authentication will still be denied for charlie. The correct answer is A because the directive explicitly denies charlie, overriding any other configuration.

Answer

Login is allowed because PasswordAuthentication is disabled, but public key authentication is enabled.

Answer

Login is allowed because AllowUsers includes other users but does not deny charlie.

Answer

Login is denied because charlie's IP address is not in the allowed list.

Question 8

A system administrator wants to ensure that all commands executed by root are logged to a remote syslog server. Which rsyslog configuration directive should be used?

Accepted Answer

authpriv.* @192.168.1.100. Option B is correct because the `authpriv` facility in rsyslog is specifically designated for security and authorization messages, including all commands executed by root via `sudo` or direct login. The directive `authpriv.* @192.168.1.100` sends all messages from this facility to the remote syslog server at UDP port 514. This matches the requirement to log root's commands, as Linux systems typically log such events under the `authpriv` facility.

Answer

auth.* @192.168.1.100

Answer

user.* @192.168.1.100

Answer

kern.* @192.168.1.100

Question 9

An organization requires that all email traffic from their mail server must be encrypted in transit. Which of the following is the most appropriate solution?

Accepted Answer

Enable STARTTLS on the SMTP server to encrypt connections.. STARTTLS is the standard method for upgrading a plaintext SMTP connection to an encrypted one using TLS, as defined in RFC 3207. It allows the mail server to negotiate encryption on the standard SMTP port (25) or submission port (587), ensuring that email traffic is encrypted in transit without requiring a separate port or protocol. This is the most appropriate solution because it is widely supported, interoperable, and aligns with modern email security best practices.

Answer

Implement IPsec to encrypt all traffic between mail servers.

Answer

Use SMTPS (SMTP over SSL) on port 465.

Answer

Configure the mail server to use SSH tunneling for all SMTP connections.

Question 10

Which file is used to configure which users and groups are allowed to use the 'cron' daemon?

Accepted Answer

/etc/cron.allow. The /etc/cron.allow file explicitly lists users and groups permitted to schedule cron jobs. If this file exists, only those entries can use crontab; all others are denied, regardless of /etc/cron.deny. This provides a whitelist-based access control mechanism for the cron daemon.

Answer

/var/spool/cron/

Answer

/etc/cron.d/

Answer

/etc/crontab