Security practice questions

firewall-cmd --add-port=8443/tcp --permanent && firewall-cmd --reload

The --permanent flag writes the rule into firewalld's runtime-to-permanent configuration, so it survives reboot; --reload then applies it immediately. Omitting --permanent would leave the port open only until the next reload or restart, failing the persistence requirement.

The SELinux boolean for the application is disabled.

Enforcing mode blocks the write despite a correct file context because a boolean governing the application's domain is off. Booleans toggle specific policy allowances without relabelling; enabling the relevant boolean permits the write while keeping SELinux enforcing.

getenforce

getenforce queries the kernel and prints the active SELinux mode — Enforcing, Permissive or Disabled — satisfying the requirement to display the current mode. Commands such as sestatus give broader status detail, while setenforce changes the mode rather than reporting it.

auditctl -w /etc/shadow -p rwxa -k shadow

Correct because `-w /etc/shadow -p rwxa` watches the file for all access types (read, write, execute, attribute change), auditing every attempt to access the file.

lastlog

lastlog reads /var/log/lastlog and reports each user's most recent successful login, satisfying the requirement to display last login times for all users. Unlike last, which reads wtmp and shows login history, lastlog gives one summary line per account, including accounts that have never logged in.

openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr

The `-newkey rsa:2048` flag generates the RSA private key alongside the CSR in a single invocation, satisfying the one-step constraint. `-nodes` omits passphrase encryption on the key, while `-keyout` and `-out` direct the private key and CSR to their respective files.

nft list ruleset

nft list ruleset dumps every table, chain and rule in the current nftables configuration, giving the administrator the full picture needed to troubleshoot a complex ruleset. It satisfies the listing half of the stem's requirement.

nft add rule inet filter input tcp dport 443 accept

nft add rule appends a rule to the specified chain, here accepting inbound TCP port 443 within the inet filter input chain. It satisfies the stem's requirement for a command that adds a new rule to the ruleset.

chage -M 90 username

`chage -M 90 username` sets the maximum password age to 90 days in `/etc/shadow`, satisfying the stem's expiry requirement. Unlike `passwd`, which only changes a password interactively, `chage` directly modifies account ageing fields, so the user must reset their password once the 90-day maximum elapses.

chage -M 60 serviceacct && chage -d 0 serviceacct

chage -M 60 sets the maximum password age to 60 days, satisfying the rotation policy, while -d 0 forces an immediate change on next login. Together they enforce rotation for the service account without altering its shell or login permissions.

auth required pam_tally2.so deny=5 unlock_time=900

pam_tally2 can also be used for account lockout with similar options.

auth required pam_faillock.so deny=5 unlock_time=900

This configures pam_faillock to deny after 5 attempts and unlock after 15 minutes.

firewall-cmd --zone=internal --add-service=ssh --add-source=10.0.0.0/8 --permanent

The --permanent flag writes the rule to firewalld's persistent configuration, satisfying the requirement that SSH be restricted to 10.0.0.0/8. Binding the ssh service to the internal zone with --add-source scopes access to that subnet, so only internal-network hosts can reach SSH.

getenforce

`getenforce` queries the running SELinux policy state directly, returning Enforcing, Permissive or Disabled. It satisfies the stem's requirement to display the current mode without altering configuration, unlike `setenforce`, which changes it, or `sestatus`, which reports broader policy detail beyond the mode itself.

auditctl -w /etc/passwd -p wa -k passwd_changes

The -w flag places a watch on the /etc/passwd file, -p wa captures both write and attribute-change events, and -k tags records with the passwd_changes key for later ausearch filtering. This combination directly satisfies the requirement to monitor modifications to that file.

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes

The req subcommand with -x509 generates a self-signed certificate directly, while -newkey rsa:2048 creates the private key in one pass. -keyout and -out write the key and certificate, -days 365 sets validity, and -nodes omits passphrase encryption, satisfying the self-signed certificate requirement.

usermod -e 1 username

Setting the account expiry date to 1 (1 January 1970) via usermod -e immediately invalidates the login, satisfying the audit requirement to disable leavers' accounts without deleting them. The past date blocks authentication while preserving the account and its file ownership for auditing.

usermod -L username

`usermod -L` prefixes the stored password hash with an exclamation mark in `/etc/shadow`, immediately blocking password-based logins for that account while leaving the account, home directory and file ownership intact. This satisfies the audit requirement to disable a departing employee's account instantly, without deleting data or disrupting audit trails.

aa-status

aa-status reports which AppArmor profiles are loaded, whether each is in enforce or complain mode, and which processes are confined. This gives the administrator visibility of profile state when configuring a custom application, satisfying the requirement for a profile management command.

aa-complain

aa-complain switches a profile into complain mode, logging policy violations without blocking the application. This lets the administrator observe what a custom application requires before writing enforcement rules, satisfying the requirement for a command that manages AppArmor profiles.

aa-enforce

aa-enforce switches an AppArmor profile from complain mode into enforcement mode, actively blocking operations the profile denies. It is one of the profile-management tools, alongside aa-complain, aa-disable and aa-status, so it satisfies the requirement to manage profiles for the custom application.

iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -j ACCEPT

Appending an INPUT rule matching TCP port 22 with source 10.0.0.0/8 and target ACCEPT satisfies the stem's SSH restriction, permitting only that network's inbound connections. Because iptables evaluates rules sequentially, this ACCEPT must precede the blanket DROP, otherwise legitimate SSH packets from 10.0.0.0/8 would be discarded before reaching it.

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

The state match accepts packets belonging to already-established or related connections, so return traffic for outbound sessions is not dropped by the default deny policy. Without it, replies to the administrator's own SSH sessions would be blocked, breaking connectivity despite the source-restricted allow rule.

useradd jdoe

`useradd jdoe` creates the account and, via `/etc/default/useradd` and `/etc/login.defs`, automatically provisions the home directory and a default primary group matching the username. This satisfies the stem's requirement to add the user with a home directory and default group in a single command, without extra flags.

wheel

On RHEL-family systems, membership of the wheel group grants sudo privileges via the default sudoers entry, letting alice run commands as root without an explicit per-user entry. This satisfies the scenario where alice is absent from the sudoers file yet still escalates.

firewall-cmd --add-service=ssh --permanent

The --permanent flag writes the rule into firewalld's persistent configuration rather than only the runtime set, satisfying the requirement that the SSH allowance survives reloads and reboots. Omitting it would apply the rule only until the next reload.