CCNA Lxp Security Questions

`pam_pwhistory` stores previous password hashes in `/etc/security/opasswd` and compares each new password against them, rejecting any match. The `remember=5` directive retains the last five hashes, directly satisfying the policy's no-reuse constraint for the previous five passwords.

openssl s_client initiates a TLS connection to the specified host and port, displaying the server's certificate chain and the result of the handshake. Using port 636, the standard LDAPS port, this command verifies that the LDAP server presents a valid certificate and that TLS negotiation succeeds, directly addressing the requirement.

AllowGroups ops restricts SSH logins to members of the ops group, satisfying the requirement that only that group connects. When AllowGroups is set, all users outside the listed groups are denied, regardless of other account settings.

--add-port=8443/tcp adds the port to the default zone's permanent configuration, and --permanent ensures it survives firewalld reloads and reboots. A runtime-only change would vanish on reload, so the permanent flag is essential to the stem's requirement.

sha256sum computes the SHA-256 hash of the specified file and prints it, which the administrator can compare against the vendor's published checksum. It is the standard coreutils tool for this purpose and directly fulfills the integrity verification task. A match confirms the file matches the expected content.

pam_pwquality enforces length, character-class and complexity checks through its minlen, ucredit and dcredit parameters, directly satisfying the 12-character minimum plus uppercase and digit requirements. It supersedes the older pam_cracklib module and integrates with the password stack.

nft list ruleset prints every table, chain and rule in the current nftables configuration, giving a complete view of loaded rules across all families. This satisfies the requirement to view all current rules without specifying a particular table.

This rule appends to the INPUT chain, matching TCP destination port 22 with source 192.168.1.0/24 and accepting it. It satisfies the requirement to permit SSH only from that subnet, and must precede the blanket INPUT drop so legitimate SSH is not discarded.

Configuring pam_pwquality.so in /etc/pam.d/common-password enforces the auditor's complexity requirement directly, using parameters such as minlen=12, ucredit=-1 and dcredit=-1 to mandate twelve characters, one uppercase letter and one digit. Unlike pam_cracklib.so, it reads settings from /etc/security/pwquality.conf, centralising policy across services.

Combines key generation and self-signing in a single invocation: -newkey rsa:2048 creates the 2048-bit RSA private key, -x509 emits a self-signed certificate rather than a CSR, -days 365 sets validity, and -nodes omits key encryption.

This command queries the fail2ban server for the status of the sshd jail, showing currently banned IPs, total failed attempts, and other statistics. It is the correct way to verify that the jail is active and functioning as intended for SSH protection.

This entry grants user 'ops' on host 'webserver' permission to run only that exact systemctl restart command as root, with no wildcards or broader command scope. It satisfies the least-privilege constraint by restricting sudo to the single specified command on the specified host.

/etc/shadow stores hashed passwords plus ageing fields such as last change, minimum, maximum and warning days, readable only by root. This satisfies the requirement for a file holding both hashed passwords and password ageing information.

Disables password logins, reducing risk of brute force.

The pam_sss module works with SSSD to authenticate users. When SSSD is configured with caching (e.g., cache_credentials = True), it stores user credentials locally, allowing offline authentication when the central server is unreachable. This is the standard method for providing cached credentials in modern Linux environments.

Uncommenting `%wheel ALL=(ALL) ALL` in /etc/sudoers grants the wheel group password-prompted sudo rights to run any command as any user, satisfying the "any command" requirement. Editing via visudo validates syntax before saving, preventing a corrupted sudoers file that would lock out all sudo access.

The `-x509` flag makes `req` emit a self-signed certificate rather than a certificate signing request, while `-newkey rsa:2048` generates the private key alongside it. `-keyout` and `-out` write both files in a single invocation, satisfying the requirement to create certificate and key together.

PasswordAuthentication no forces public-key authentication, and AllowUsers alice bob permits bob, so bob can log in with a public key. PermitRootLogin no blocks root, and MaxAuthTries 2 limits attempts, but neither prevents bob's key-based login.

audit2allow reads SELinux denial records from the audit log and generates allow rules targeting the exact permissions the service was refused. This produces the minimum policy change needed, rather than disabling enforcement or granting broad access, directly satisfying the requirement to suggest least-privilege policy adjustments.

This command adds a permanent rich rule to the public zone that accepts IPv4 traffic from the specified subnet to TCP port 443, then reloads firewalld to apply the change immediately. The --permanent flag ensures the rule survives reboots, and the reload activates it without dropping existing connections.

Using LDAPS (LDAP over TLS) encrypts the authentication traffic. Setting TLS_REQCERT to demand enforces certificate validation, ensuring the client verifies the server's certificate. This meets both the encryption and validation requirements. It is a standard way to secure LDAP communications.

Chaining genrsa with req -new -x509 produces both the private key and a self-signed certificate in one pass. The -x509 flag makes req emit a certificate rather than a signing request, satisfying the self-signed requirement without a separate CA step.

On Debian-based systems, the PAM and SSH authentication subsystems write both successful and failed login events to /var/log/auth.log, making it the file that records authentication outcomes. Other distributions use /var/log/secure instead, but Debian's convention is auth.log.

Running `sestatus` queries the SELinux kernel subsystem and prints the current enforcement mode (Enforcing, Permissive, or Disabled) alongside policy version and loaded policy name. This directly satisfies the stem's requirement to display the current mode, unlike `setenforce`, which changes it, or `getenforce`, which shows only the mode.

This sudoers entry allows user bob to run /usr/bin/systemctl as any user (including root) without a password prompt. The NOPASSWD tag disables the password requirement, and the command is specified with its full path as required by sudoers syntax. This precisely meets the requirement to grant passwordless systemctl execution.

The pam_faillock module is designed to lock user accounts after a defined number of consecutive failed authentication attempts. Configuring it in the PAM files for system-auth and password-auth ensures that lockout applies to both login and password change operations. This directly addresses the requirement to implement account lockout, and it is the standard method on modern Linux distributions.

`pam_pwquality.so` enforces complexity at password-change time, and the negative credit values are the mechanism: `ucredit=-1` and `dcredit=-1` each demand at least one uppercase letter and one digit, while `minlen=12` sets the minimum length. The `requisite` control ensures failure blocks the password change immediately, satisfying the audit's complexity requirement.

Permissive is a valid SELinux mode: policy violations are logged but not blocked, unlike Enforcing. It satisfies the stem's requirement for a genuine SELinux operating mode, alongside Enforcing and Disabled, and is commonly used for troubleshooting before switching to enforcement.

The `last` command reads `/var/log/wtmp`, listing successful login sessions with usernames, terminal lines, source hosts and timestamps. This directly satisfies the analyst's need to examine user login history during breach investigation, showing who logged in, from where, and when.

Disables root SSH login, reducing attack surface.

The %wheel ALL=(ALL) ALL entry grants members of the wheel group permission to run any command as any user, identified by the leading % group prefix. This restricts sudo rights to wheel members alone, satisfying the requirement that only that group may use sudo.

Enabling httpd_can_network_connect_db permits the httpd_t domain to open network sockets to database ports, directly satisfying the requirement that Apache connect to a database server. Other booleans govern unrelated access, such as outbound connections generally or specific database types, so this one precisely matches the stated constraint.

/etc/security/limits.conf defines per-user and per-group ulimit values, letting the engineer apply soft and hard resource caps to the 'developers' group through a group entry, which satisfies the requirement to restrict resource usage for that group.

The nosuid mount option prevents the execution of setuid and setgid programs on that filesystem. Because the requirement is to stop users from running setuid binaries from /home, this option directly satisfies it. It is a standard hardening measure for user-writable directories and works at the kernel mount level without affecting file permissions.