CCNA Security Questions

The file carries the admin_home_t type, which Apache's httpd_t domain cannot read, causing the denial. `semanage fcontext -a -t httpd_sys_content_t` adds a persistent mapping in the file-context policy, and `restorecon` applies it to webapp.conf, satisfying the requirement that the file hold the httpd content type.

/etc/shadow stores per-user password aging fields, including minimum days, maximum days, warning period and expiry, alongside the hashed password. This directly satisfies the stem's requirement for minimum and maximum days between password changes, unlike /etc/passwd, which holds account data but no aging constraints.

`lastb` reads the binary `/var/log/btmp` record file and prints each failed login attempt with its timestamp, source host and username. Since the stem explicitly requires displaying failed logins from that specific log, `lastb` is the matching tool; `last` reads `/var/log/wtmp` for successful sessions instead.

Editing /etc/logrotate.conf sets global rotation defaults, where the weekly directive satisfies the seven-day rotation constraint and rotate 4 retains four weeks of archives before deletion. Per-service overrides belong in /etc/logrotate.d/, but the stem asks which file governs rotation policy, making this the correct target.

Configuring `maxlogins` in `/etc/security/limits.conf` enforces a per-user cap on concurrent sessions through PAM's pam_limits module, directly satisfying the requirement to restrict simultaneous logins to 2. The `hard` type makes the limit unoverrideable by the user, ensuring the constraint holds across all login methods.

The faillock utility reads the tally files that pam_faillock.so maintains and prints each user's recorded failure timestamps and count. Running it with --user username displays that account's failed attempts, letting the administrator confirm the lockout cause.

The 'ipsec statusall' command is part of the strongSwan suite and displays detailed information about all IPsec security associations (SAs), including their state, encryption algorithms, and traffic statistics. This allows the administrator to confirm that the tunnel is established and operational, and to see if any SAs are down or have errors.

pam_faillock.so counts consecutive authentication failures per account and locks it once the configured deny threshold is reached, directly enforcing the three-attempt lockout. It is inserted into the auth and account stacks of /etc/pam.d/sshd or system-auth.

Configuring pam_faillock.so enforces account lockout after repeated failed authentication attempts, directly mitigating brute-force attacks against the weak password policy identified in the audit. It operates at the PAM authentication layer, so the protection applies across all services using PAM, not SSH alone, hardening the system beyond the password-strength weakness.

The rule matches source addresses outside 192.168.1.0/24 on TCP port 22 and drops them, satisfying the requirement to block non-management SSH. Using '!=' with the saddr match and the drop verdict enforces the restriction within the inet filter input chain.

This rich rule adds a permanent rule that accepts TCP traffic to port 8080 only from the specified source subnet. Rich rules allow granular control based on source address, port, and protocol. After adding it, the administrator must reload firewalld for the rule to take effect in the running configuration.

PermitRootLogin no blocks direct root authentication over SSH, forcing administrators to log in as unprivileged users before escalating via sudo or su. This removes root as a brute-force target and preserves attributable audit trails, directly satisfying the hardening requirement to reduce remote attack surface on the SSH daemon.

The /etc/security/pwquality.conf file is used by the pam_pwquality module to enforce password complexity rules such as minimum length (minlen), required character classes (ucredit, lcredit, dcredit, ocredit), and other checks. Editing this file allows the administrator to set these requirements system-wide for all users, ensuring compliance with the security policy.

The -m flag creates the home directory and -s /bin/bash sets the login shell, satisfying both stated requirements in one command. Without -m, useradd leaves no home directory; without -s, the system default shell applies.

DenyUsers bob blocks only the named account at authentication, leaving all other users unaffected, which satisfies the stem's requirement to prevent 'bob' specifically while permitting everyone else. Applied in sshd_config and reloaded, it is evaluated before AllowUsers, so no broader access rule is needed.

AllowGroups restricts SSH logins to members of the named group, so only users in sshusers may authenticate. Unlike AllowUsers, which lists individual accounts, this directive scales by group membership, directly satisfying the requirement to limit access to that group.

The /etc/sudoers file is the primary configuration file for sudo. It allows administrators to define which users or groups can run which commands, and with what options. To grant a user passwordless execution of a specific command, an entry such as username ALL=(ALL) NOPASSWD: /path/to/command is added. This file should be edited with visudo to prevent syntax errors.

The sudo -l -U jsmith command lists the sudo privileges for the specified user, showing exactly which commands jsmith may run and whether NOPASSWD applies. This directly reveals whether the sudoers.d file is being parsed correctly and whether the rule matches the intended command path, helping diagnose why a password is still requested.

This command assigns the cap_net_bind_service capability to the webapp binary, allowing it to bind to privileged ports (below 1024) without running as root. The +ep flags set the effective and permitted capability sets, enabling the process to use the capability. This is the least-privilege approach and directly resolves the permission denied error for a non-root user.

aa-enforce switches the named AppArmor profile from complain to enforce mode, applying its deny rules. This satisfies the requirement to move the web server profile out of complain mode after testing, using the profile path as the argument.

This command uses ssh-keygen with the -s flag to specify the CA private key, -I to set the key ID, -n to define principals, -V for validity period, and the public key file to sign. It generates a certificate file named user_key-cert.pub. This is the correct syntax for signing a user's public key with a CA in OpenSSH certificate authentication.

MaxAuthTries 3 caps the number of authentication attempts permitted per connection, so brute-force guessing is throttled before an attacker can try many passwords. This directly satisfies the stem's requirement to limit authentication attempts, working alongside a setting that disables password logins.

AllowGroups restricts authentication to members of the named group only, so listing sshusers blocks every account outside it. This directly enforces the stated constraint of limiting SSH access to that group, unlike AllowUsers, which names individual accounts rather than a group.

AllowGroups restricts SSH logins to users who are members of the specified group(s). This satisfies the requirement to restrict which users can authenticate via SSH. Combined with disabling password authentication, it ensures only authorized users with keys can connect. The directive must be placed in sshd_config and sshd restarted.

Configuring pam_pwhistory with the remember=5 parameter stores previous password hashes and rejects any new password matching them, directly enforcing the five-password reuse restriction in the stem. It hooks into the password stack, so changes are blocked at the point of update rather than merely advised.

passwd -S displays the status of a user's password, including whether the account is locked (L), has no password (NP), or has a usable password (P), along with aging fields. This directly answers whether bob is locked and shows password aging details, making it the appropriate command for the administrator's check.

`aa-status` reports every loaded AppArmor profile with its current mode, satisfying the requirement to verify all profiles' status. It lists profiles as enforcing, complaining or unconfined, giving the administrator the baseline needed before switching one profile into enforce mode.

pam_pwquality enforces password complexity at change time by applying configurable rules such as minimum length, character classes and dictionary checks. Configuring it in the password stack ensures users cannot set weak passwords, directly satisfying the audit finding that complexity requirements are bypassed.

`chage -m 7 jsmith` sets the minimum number of days between password changes to seven, directly enforcing the required restriction. The `-m` flag defines this minimum interval, so `jsmith` cannot alter the password again until seven days have elapsed, satisfying the stem's constraint precisely.

The public zone target DROP will silently discard all incoming traffic that does not match an allowed service or port, meeting the default drop requirement. Outgoing traffic is not filtered by firewalld zones; the default policy allows all outbound connections. Therefore, SSH connections initiated by the server to the remote host will be permitted without additional configuration. This satisfies both conditions.

`passwd --expire alice` immediately expires alice's password, forcing a change at her next login, which satisfies the stem's requirement. Unlike `chage -d 0`, it acts instantly without editing ageing fields, and it avoids locking the account outright, so alice can still authenticate and set a new password.

/etc/security/limits.conf is read by pam_limits and defines per-user or per-group resource limits, including nproc, which caps the number of processes a user may create. This directly satisfies the requirement to limit process creation for a user.

This command uses semanage to add TCP port 8080 to the http_port_t type, which is the SELinux type that httpd is allowed to bind to. The -a flag adds a new port definition, -t specifies the type, and -p specifies the protocol. This change is persistent across reboots and allows httpd to listen on port 8080 without disabling SELinux.

This command generates an Ed25519 host key and writes it to the standard path /etc/ssh/ssh_host_ed25519_key, which sshd reads by default. The -t ed25519 selects the algorithm and -f sets the filename, matching the requirement for a default-location Ed25519 host key that the SSH daemon will automatically use.

The %wheel prefix denotes a group entry, ALL=(ALL) grants every command as any user, and NOPASSWD: ALL removes the password prompt. This line satisfies the requirement that wheel members run any command without a password.

The `-P` flag writes the change into the persistent SELinux policy, so `httpd_can_network_connect` stays enabled across reboots. Without it, `setsebool` only alters the running state, which the audit would flag again after restart. This satisfies the requirement for persistent enablement of Apache's outbound database connection.

`ssh-keygen` generates an asymmetric key pair — a private key plus a matching public key — for public-key authentication, satisfying the stem's requirement to create an SSH key pair. It writes them to `~/.ssh/id_rsa` and `id_rsa.pub` by default, and the public half is then copied to the remote host's `authorized_keys`.

`passwd -u username` unlocks a password-locked account by clearing the lock flag in `/etc/shadow`, directly satisfying the stem's requirement to unlock the account. The `-u` flag reverses a prior `passwd -l`, restoring the user's ability to authenticate with their existing password.

pam_faillock.so provides account lockout after a specified number of failed authentication attempts. It is configured in the auth and account stacks of PAM configuration files, such as /etc/pam.d/system-auth and /etc/pam.d/password-auth. This module satisfies the account lockout requirement and is the current standard on Red Hat and similar distributions.

/etc/shadow holds the encrypted password hashes plus password aging fields such as last change, minimum and maximum age, warning period, and account expiry. This separates sensitive hashes from world-readable /etc/passwd, satisfying the question's description of its purpose.

`pam_faillock.so` counts consecutive failed authentications per account and locks the account once the threshold is reached, satisfying the five-attempt lockout requirement. Configure it via `pam_faillock` in both the `auth` and `account` stacks, since the `account` phase enforces the lockout after the counter trips.

pam_faillock tracks failed authentication attempts per account and locks the account once the configured threshold is reached, satisfying the three-attempt lockout constraint. Unlike pam_tally2, which is deprecated, pam_faillock integrates with the auth and account stacks and supports per-user unlock intervals, making it the current standard module for this enforcement.

The pam_pwquality.so module enforces complexity rules through its ucredit, dcredit and minlen parameters, directly satisfying the policy's uppercase, digit and 12-character requirements. Placed in /etc/pam.d/common-password, it intercepts password changes via the password stack, rejecting non-compliant entries at update time.

The -m flag instructs useradd to create the home directory /home/jdoe, while -s /bin/bash sets the login shell, satisfying both stated requirements. Without -m, no home directory is created, and the default shell would otherwise come from /etc/default/useradd.

This command sends a SIGHUP to the sshd service, causing it to re-read its configuration file while keeping existing connections alive. It is the standard way to apply changes to /etc/ssh/sshd_config without dropping active sessions, which is exactly what the administrator needs to verify the PermitRootLogin setting.

The unconfined_t type places the process outside SELinux policy enforcement, so type enforcement rules do not restrict it. Confined domains such as httpd_t are limited by policy; unconfined processes retain standard discretionary access controls only.

PermitRootLogin no blocks direct root SSH sessions, forcing administrators to authenticate as unprivileged users before escalating via sudo. PasswordAuthentication no disables password-based logins entirely, requiring key-based authentication instead. Together these directives satisfy both hardening constraints in the stem, eliminating brute-force and credential-guessing attack vectors against the SSH daemon.

The -x509 flag makes openssl req emit a self-signed certificate rather than a CSR, while -newkey rsa:2048 generates the private key in the same invocation. This satisfies the stem's one-step requirement, producing both key.pem and cert.pem without a separate signing command.

Appending to the INPUT chain with `-A` matches inbound packets, while `-p tcp --dport 22 -s 10.0.0.100` filters TCP destined for port 22 from that source, and `-j DROP` discards them silently. This satisfies the requirement to drop incoming SSH traffic from 10.0.0.100.

ausearch retrieves the full AVC denial records from the audit log, while audit2allow converts those denials into allow rules for a loadable policy module. Together they reveal the complete denial and generate the targeted SELinux policy.

aa-enforce switches the named AppArmor profile from complain to enforce mode, so the kernel actively denies operations the profile disallows rather than merely logging them. Specifying the profile path targets exactly the service the stem says should be enforcing.

`aa-complain` switches an AppArmor profile from enforce to complain mode, logging policy violations without blocking the application. This directly satisfies the administrator's requirement to gather violations without enforcement, unlike `aa-enforce`, which would keep blocking. Passing the profile path targets that specific profile rather than all loaded profiles.

`visudo` safely edits the sudoers configuration, validating syntax before saving so a malformed rule cannot lock out sudo access. It satisfies the audit requirement to review and modify excessive privileges by letting the administrator inspect and amend existing user entries, and it respects file locking to prevent concurrent edits.

PermitRootLogin no directly blocks root authentication over SSH, satisfying the requirement to disable root login. The directive accepts values such as yes, no, prohibit-password and forced-commands-only; setting no rejects all root logins regardless of authentication method, which is stricter than prohibit-password. The sshd service must be reloaded for the change to take effect.

The entry jdoe ALL=(ALL) ALL grants jdoe permission to run any command as any user on all hosts, and sudo prompts for jdoe's own password by default. This satisfies both constraints: full root command access without sharing the root password.

The `restorecon -R /path/to/file` command recursively resets SELinux contexts to the values defined in the system's file-context policy, satisfying the requirement to relabel a file or directory to its correct context. Unlike `chcon`, which applies a manually specified context, `restorecon` reads the persistent policy mapping, ensuring the audit finding is resolved durably.

The /etc/security/pwquality.conf file is the central configuration file for the pam_pwquality module, which enforces password complexity rules. Parameters like minlen, ucredit, lcredit, dcredit, and ocredit can be set here to require minimum length and character classes. Editing this file applies the policy system-wide for all users when they change their passwords.

PermitRootLogin no directly disables root authentication over SSH, satisfying the requirement to block root logins. The sshd daemon reads this directive at startup and rejects any authentication attempt for the root account, regardless of password or key. Other values such as prohibit-password still allow key-based root access, so only "no" fully prevents it.

The --permanent flag writes the rule into firewalld's persistent configuration rather than only the runtime zone, meeting the requirement that the port stay open across reboots or reloads. The --add-port=8080/tcp argument specifies the exact port and protocol in the default zone.

setenforce 0 switches SELinux from enforcing to permissive mode immediately in the running kernel. In permissive mode, policy violations are logged but not blocked, which is exactly the temporary change requested. The command takes effect without a reboot and does not alter the persistent configuration in /etc/selinux/config.

The pam_pwquality module reads its configuration from /etc/security/pwquality.conf, where parameters like minlen, dcredit, and ucredit are defined. Setting minlen = 12 in this file enforces a minimum password length of 12 characters for all users, assuming the PAM stack includes pam_pwquality.

The `--permanent` flag writes the rule to firewalld's persistent configuration rather than only the runtime set, satisfying the requirement to add the port permanently. Without it, the change would vanish on reload or reboot. The command targets the default zone automatically, so no `--zone` argument is needed.

The aa-complain command sets the specified AppArmor profile to complain mode, where violations are logged but not blocked. This allows the application to write to the log directory while generating audit entries that reveal which rules need adjustment. It is the correct tool for temporary diagnosis without unloading the profile.

ausearch with -k filters the audit log by the rule's key, returning every event tagged passwd_changes. Since the watch was loaded with that exact key, this is the precise selector for retrieving all related events.

Disabling direct root logins forces administrators to authenticate as a normal user and then escalate privileges, which adds accountability and reduces the impact of brute-force attacks against the root account. This is a standard SSH hardening measure and directly limits a high-value authentication path on the web server.

PermitRootLogin no blocks direct root logins over SSH, satisfying the stem's first hardening requirement. Setting it to no forces administrators to authenticate as an unprivileged user first, typically escalating via sudo, which removes a high-value brute-force target.

pam_faillock.so tracks failed authentication attempts per account and enforces lockout once the threshold is crossed. Setting deny=5 satisfies the five-attempt policy, while unlock_time=900 locks the account for fifteen minutes, matching the required window. Unlike pam_tally2, it integrates with faillock and supports per-user tally files.

When the file is encrypted and the decryption key resides only off the server, possession of root on that host yields nothing but ciphertext. Access control is enforced by cryptography rather than by the kernel's permission model, so even the superuser cannot recover the ledger contents without the external key.

useradd -m creates the home directory and -s /bin/bash sets the login shell, satisfying both stated requirements in a single command. Without -m, no home directory is created; without -s, the system default shell applies.

getcap reads and displays the file capabilities stored in the security.capability extended attribute of a binary. For /usr/bin/ping, it would report cap_net_raw=ep, confirming the binary can open raw sockets without setuid root. This is exactly the inspection the administrator needs to verify least-privilege configuration on the ping utility.

PermitRootLogin no blocks direct superuser SSH access, forcing administrators to log in as themselves before elevating. AllowGroups sshusers restricts authentication to members of that group via the AllowGroups directive, satisfying both hardening constraints. DenyUsers or AllowUsers would not reference group membership.

/etc/shadow stores the hashed passwords alongside ageing fields such as last change, minimum, maximum and warning days, which /etc/passwd does not hold. It is readable only by root, restricting hash exposure. This satisfies the requirement for both password hashes and ageing information in one file.

`chage -M 60 jsmith` sets the maximum password age to 60 days, satisfying the policy's mandatory 60-day rotation. The `-M` flag defines the exact interval between required changes, after which the account forces a new password. It does not configure the 7-day warning, so a second command using `-W 7` is still needed.

In /etc/security/pwquality.conf, the minlen parameter specifies the minimum acceptable length for a new password. Setting minlen = 12 enforces that all new passwords are at least 12 characters long. This is the correct directive for the pwquality PAM module, which is commonly used on modern Linux distributions.

ausearch extracts the AVC denial records from the audit log and pipes them into audit2allow, which translates the denials into allow rules and compiles them into a loadable module named myapp. This satisfies the requirement to generate a policy module granting the write access.