--- title: "LPIC-2 Linux Engineer Flashcards" description: "Full exam coverage for the LPIC-2 Linux Engineer certification (Exam 201 & 202) using spaced repetition. Covers kernel, boot, storage, networking, security, DNS, web, email, and more." author: "Mohammad Abu Mattar" canonical: https://mkabumattar.com/flashcards/post/lpic-2-linux-engineer-flashcards --- # LPIC-2 Linux Engineer Flashcards ## Flashcards ### 1. What tools are used for Linux system resource monitoring? vmstat virtual memory, CPU, and I/O statistics. iostat CPU and disk I/O statistics. sar system activity reporter, historical data via sysstat. mpstat per-CPU statistics. free memory and swap usage. uptime load averages over 1, 5, and 15 minutes. ``` $ vmstat 2 5 # 5 samples every 2 seconds $ iostat -xz 2 $ sar -u 2 5 # CPU history $ sar -r # memory history ``` ### 2. What is the load average and how do you interpret it? Load average represents the average number of processes in a runnable or uninterruptible sleep state over 1, 5, and 15 minutes. A load of 1.0 on a single-core system means full utilization. On a 4-core system, a load of 4.0 means full utilization. Values consistently above the CPU count indicate overload. ``` $ uptime 12:00 up 5 days, load average: 0.52, 0.38, 0.29 ``` ### 3. What is the ulimit command and why is it important for capacity? ulimit sets per-process resource limits (open files, stack size, max processes, memory). Limits prevent runaway processes from exhausting system resources. Hard limits are set by root; soft limits can be adjusted by users within the hard limit. Persistent limits go in /etc/security/limits.conf. ``` $ ulimit -a # show all limits $ ulimit -n 65536 # set open file limit # /etc/security/limits.conf * soft nofile 65536 * hard nofile 65536 ``` ### 4. What is /proc/meminfo and what key fields does it contain? /proc/meminfo is a virtual file exposing kernel memory statistics. Key fields MemTotal (total RAM), MemFree (unused RAM), MemAvailable (available for new processes), Buffers, Cached, SwapTotal, SwapFree. Use it to understand actual memory pressure. ``` $ cat /proc/meminfo $ grep -E "MemTotal|MemAvailable|SwapFree" /proc/meminfo ``` ### 5. What tools measure disk I/O performance? iostat reports block device utilization and throughput. iotop shows per-process I/O usage in real time. hdparm -tT benchmarks disk read speed. blktrace traces block layer I/O events for deep analysis. ``` $ iostat -xz 1 $ sudo iotop -o # only show active I/O $ sudo hdparm -tT /dev/sda ``` ### 6. What is the Linux kernel and where are kernel images stored? The Linux kernel is the core of the OS managing hardware, processes, memory, and I/O. Kernel images are stored in /boot/ vmlinuz- (compressed kernel), initrd.img- (initial RAM disk), System.map- (symbol table), and config- (build config). ``` $ ls /boot/ vmlinuz-6.1.0 initrd.img-6.1.0 System.map-6.1.0 ``` ### 7. How do you compile a custom Linux kernel? Download source, configure with make menuconfig (or make defconfig), compile with make -j$(nproc), install modules with make modules_install, install kernel with make install (updates /boot and bootloader), then reboot. ``` $ tar xvf linux-6.x.tar.xz && cd linux-6.x $ make menuconfig $ make -j$(nproc) $ sudo make modules_install $ sudo make install ``` ### 8. What is the Linux kernel module system? Kernel modules are loadable pieces of kernel code (device drivers, filesystems) that can be loaded/unloaded at runtime without rebooting. They extend kernel functionality on demand. Module files have .ko extension and live in /lib/modules/$(uname -r)/. ### 9. What are the key kernel module management commands? lsmod list loaded modules. modinfo show module details and parameters. modprobe load module with dependencies. modprobe -r unload module and dependencies. insmod load a module directly (no dependency handling). rmmod unload a module. ``` $ lsmod | grep ext4 $ modinfo ext4 $ sudo modprobe ext4 $ sudo modprobe -r ext4 ``` ### 10. What is /etc/modules-load.d/ and /etc/modprobe.d/? /etc/modules-load.d/*.conf lists modules to load automatically at boot. /etc/modprobe.d/*.conf contains module configuration aliases, options (parameters), and blacklists to prevent automatic loading of specific modules. ``` # /etc/modules-load.d/mymod.conf br_netfilter # /etc/modprobe.d/blacklist.conf blacklist nouveau ``` ### 11. What does uname -r and uname -a show? uname -r prints the running kernel version. uname -a prints all system information kernel name, hostname, kernel release, kernel version, machine hardware, processor, and OS. ``` $ uname -r 6.1.0-17-amd64 $ uname -a Linux host 6.1.0-17-amd64 #1 SMP x86_64 GNU/Linux ``` ### 12. What is /proc/sys/ and the sysctl command? /proc/sys/ exposes tunable kernel parameters at runtime. sysctl reads and writes these parameters. Persistent settings go in /etc/sysctl.conf or /etc/sysctl.d/*.conf and are applied with sysctl -p. ``` $ sysctl kernel.hostname $ sysctl -w net.ipv4.ip_forward=1 $ sysctl -p /etc/sysctl.conf # Persistent: echo "net.ipv4.ip_forward=1" >> /etc/sysctl.d/99-ip-forward.conf ``` ### 13. What is the Linux boot process from BIOS to login? 1. BIOS/UEFI POST, finds bootable device. 2. Bootloader (GRUB2) loads kernel and initrd from /boot. 3. Kernel decompresses, initializes hardware, mounts initramfs. 4. initramfs temporary root FS, loads drivers, mounts real root. 5. init/systemd (PID 1) starts all services and targets. 6. Login prompt getty or display manager. ### 14. What is GRUB2 and its configuration files? GRUB2 (GRand Unified Bootloader version 2) is the default bootloader for most Linux distributions. The main config is /boot/grub/grub.cfg (auto-generated do not edit directly). Edit /etc/default/grub for settings, add custom entries to /etc/grub.d/, then regenerate with grub-mkconfig or update-grub. ``` $ sudo vim /etc/default/grub GRUB_TIMEOUT=5 GRUB_CMDLINE_LINUX="quiet splash" $ sudo grub-mkconfig -o /boot/grub/grub.cfg # or on RHEL/Fedora: $ sudo grub2-mkconfig -o /boot/grub2/grub.cfg ``` ### 15. What is initramfs and what is its purpose? initramfs (initial RAM filesystem) is a compressed cpio archive loaded into memory by the bootloader. It provides a minimal root filesystem with just enough drivers and tools to mount the real root filesystem. It handles encrypted disks, LVM, RAID, and network booting. ``` $ lsinitramfs /boot/initrd.img-$(uname -r) # Debian $ lsinitrd /boot/initramfs-$(uname -r).img # RHEL ``` ### 16. How do you rebuild the initramfs? On Debian/Ubuntu use update-initramfs -u. On RHEL/Fedora use dracut -f. Rebuilding is required after installing new kernel modules or changing the kernel configuration. ``` $ sudo update-initramfs -u # Debian/Ubuntu $ sudo dracut -f # RHEL/Fedora $ sudo dracut -f --kver $(uname -r) ``` ### 17. What are GRUB2 kernel command-line parameters? Kernel parameters are passed via GRUB's GRUB_CMDLINE_LINUX. Common ones quiet (suppress boot messages), splash (show splash screen), rd.lvm.lv (activate LVM volume), root= (root device), ro/rw (mount root read-only/read-write), systemd.unit= (boot into a specific target), init=/bin/bash (boot to shell for recovery). ``` # Boot to rescue target via GRUB editor (press 'e') linux /vmlinuz root=/dev/sda1 ro systemd.unit=rescue.target ``` ### 18. What is the Linux Virtual Filesystem (VFS)? The VFS is a kernel abstraction layer that provides a uniform interface for all filesystems (ext4, XFS, Btrfs, NFS, etc.). Applications use standard system calls (open, read, write) regardless of the underlying filesystem type. ### 19. What are the most common Linux filesystems and their features? ext4 journaling, backward compatible, max 1EB volume, default on Debian/Ubuntu. XFS high performance, parallel I/O, online resize (grow only), default on RHEL. Btrfs copy-on-write, snapshots, built-in RAID, checksums, subvolumes. vfat/FAT32 cross-platform, used for /boot/efi (EFI partition). tmpfs RAM-based, used for /tmp and /run. ### 20. What is a filesystem journal? A journal records pending metadata (and optionally data) changes before committing them to the filesystem. If a crash occurs, the journal is replayed on remount, ensuring filesystem consistency without full fsck. ext4, XFS, and Btrfs are all journaling filesystems. ### 21. What is fsck and when should you use it? fsck (filesystem check) checks and repairs filesystem inconsistencies. Run it only on unmounted filesystems. On ext4, tune2fs -l shows the last check time; e2fsck -f forces a check. XFS uses xfs_repair. Modern journaling filesystems rarely need manual fsck. ``` $ sudo umount /dev/sdb1 $ sudo fsck -y /dev/sdb1 # auto-fix $ sudo e2fsck -f /dev/sdb1 # ext4 forced check $ sudo xfs_repair /dev/sdb1 # XFS ``` ### 22. What are filesystem mount options and where are they set? Mount options control filesystem behavior noatime (don't update access time), relatime (update atime only if older than mtime), noexec (prevent execution), nosuid (ignore suid bits), ro (read-only). Set in /etc/fstab for persistent mounts or with mount -o for temporary mounts. ``` # /etc/fstab UUID=abc-123 /data xfs defaults,noatime 0 2 $ sudo mount -o remount,noatime /data ``` ### 23. What is udev and what does it do? udev is the Linux device manager. It dynamically creates and removes device files in /dev/ when hardware is added or removed. udev rules (in /etc/udev/rules.d/ and /lib/udev/rules.d/) match device attributes and set names, permissions, symlinks, and run scripts. ``` $ udevadm info /dev/sda $ udevadm monitor # watch device events # Custom rule # /etc/udev/rules.d/99-usb.rules SUBSYSTEM=="usb", ATTR{idVendor}=="1234", SYMLINK+="mydevice" ``` ### 24. What is LVM and its three layers? LVM (Logical Volume Manager) abstracts physical storage into flexible logical volumes: PV (Physical Volume) raw disk or partition initialized for LVM. VG (Volume Group) pool of one or more PVs. LV (Logical Volume) virtual partition carved from a VG, formatted and mounted. ``` $ sudo pvcreate /dev/sdb /dev/sdc $ sudo vgcreate datavg /dev/sdb /dev/sdc $ sudo lvcreate -L 20G -n datalv datavg $ sudo mkfs.xfs /dev/datavg/datalv ``` ### 25. What are LVM snapshots? LVM snapshots create a point-in-time copy of a logical volume using copy-on-write. Only changed blocks are stored separately. Snapshots are used for backups without downtime and for testing. They require free space in the VG and should be removed after use. ``` $ sudo lvcreate -L 5G -s -n snap_datalv /dev/datavg/datalv $ sudo mount /dev/datavg/snap_datalv /mnt/snapshot $ sudo lvremove /dev/datavg/snap_datalv ``` ### 26. What is RAID and what are the common levels? RAID (Redundant Array of Independent Disks) combines multiple disks: RAID 0 striping, no redundancy, max performance. RAID 1 mirroring, full redundancy, 50% capacity. RAID 5 striping with parity, 1 disk fault tolerance, N-1 capacity. RAID 6 striping with dual parity, 2 disk fault tolerance. RAID 10 mirror of stripes, high performance + redundancy. ### 27. What is mdadm and how do you create a software RAID? mdadm manages Linux software RAID arrays. Create arrays with mdadm --create, monitor with mdadm --detail, and persist config in /etc/mdadm/mdadm.conf. ``` $ sudo mdadm --create /dev/md0 \ --level=1 --raid-devices=2 /dev/sdb /dev/sdc $ sudo mdadm --detail /dev/md0 $ sudo mdadm --detail --scan >> /etc/mdadm/mdadm.conf ``` ### 28. What is iSCSI and how is it configured on Linux? iSCSI (Internet Small Computer System Interface) transports SCSI commands over TCP/IP, allowing block storage access over a network. The server is an iSCSI target (targetcli); the client is an iSCSI initiator (iscsiadm). The initiator IQN identifies each host. ``` $ sudo iscsiadm -m discovery -t st -p 192.168.1.100 $ sudo iscsiadm -m node --login $ lsblk # new block device appears ``` ### 29. What is NFS and how do you configure it? NFS (Network File System) shares directories over a network. The server exports directories via /etc/exports. Clients mount them with mount or /etc/fstab. NFSv4 is the current standard with better security (Kerberos support) and performance. ``` # Server: /etc/exports /shared 192.168.1.0/24(rw,sync,no_subtree_check) $ sudo exportfs -ra $ sudo systemctl enable --now nfs-server # Client: $ sudo mount -t nfs 192.168.1.10:/shared /mnt/nfs ``` ### 30. What is Btrfs and its key features for sysadmins? Btrfs (B-tree filesystem) is a modern Linux filesystem with copy-on-write, built-in RAID (0/1/10), subvolumes (independent directory trees), snapshots (instant, space-efficient), online defragmentation, and transparent compression (zstd, lzo, zlib). ``` $ sudo mkfs.btrfs /dev/sdb $ sudo btrfs subvolume create /mnt/data/@home $ sudo btrfs subvolume snapshot /mnt/data /mnt/data/snap_$(date +%F) $ sudo btrfs filesystem df /mnt/data ``` ### 31. What is smartmontools and disk health monitoring? smartmontools uses the SMART (Self-Monitoring, Analysis and Reporting Technology) built into hard drives and SSDs to report health status, predict failures, and run diagnostic tests. smartctl queries individual drives; smartd runs as a daemon for continuous monitoring. ``` $ sudo smartctl -a /dev/sda # full SMART report $ sudo smartctl -t short /dev/sda # run short test $ sudo smartctl -H /dev/sda # quick health check ``` ### 32. What is the difference between static and dynamic IP configuration? A static IP is manually assigned and never changes used for servers and network devices. A dynamic IP is assigned by a DHCP server and may change used for workstations. Configure static IPs in /etc/network/interfaces (Debian), nmcli/nmtui (RHEL/modern), or netplan (Ubuntu server). ### 33. How do you configure a static IP with nmcli? Use nmcli connection modify to set a static IP, gateway, DNS, and disable DHCP. Apply with nmcli connection up. ``` $ nmcli con mod "Wired connection 1" \ ipv4.addresses 192.168.1.100/24 \ ipv4.gateway 192.168.1.1 \ ipv4.dns "8.8.8.8 8.8.4.4" \ ipv4.method manual $ nmcli con up "Wired connection 1" ``` ### 34. What is network bonding in Linux? Network bonding combines multiple physical NICs into a single logical interface for redundancy or increased throughput. Bonding modes mode 0 (round-robin), mode 1 (active-backup, HA), mode 4 (802.3ad LACP, requires switch support), mode 5/6 (adaptive load balancing). ``` $ sudo modprobe bonding $ nmcli con add type bond ifname bond0 bond.options "mode=active-backup" $ nmcli con add type ethernet ifname eth0 master bond0 $ nmcli con add type ethernet ifname eth1 master bond0 ``` ### 35. What is network bridging in Linux? A bridge connects multiple network interfaces at Layer 2, forwarding frames between them. It is essential for KVM/QEMU virtualization to give VMs access to the physical network. Use nmcli or brctl (deprecated) to configure bridges. ``` $ nmcli con add type bridge ifname br0 $ nmcli con add type ethernet ifname eth0 master br0 $ nmcli con mod br0 bridge.stp no $ nmcli con up br0 ``` ### 36. What is a VLAN and how is it configured in Linux? A VLAN (Virtual LAN) segments a physical network into multiple isolated logical networks using IEEE 802.1Q tagging. Linux supports VLANs via the 8021q module. Create VLAN interfaces with ip link or nmcli. ``` $ sudo modprobe 8021q $ ip link add link eth0 name eth0.100 type vlan id 100 $ ip addr add 192.168.100.1/24 dev eth0.100 $ ip link set eth0.100 up ``` ### 37. What is the /etc/hosts file vs DNS resolution order? /etc/hosts is a local static hostname-to-IP mapping file checked before DNS. The resolution order is defined by /etc/nsswitch.conf typically files (hosts file) then dns. Use getent hosts to test name resolution through nsswitch. ``` # /etc/nsswitch.conf hosts: files dns myhostname $ getent hosts www.example.com ``` ### 38. What are common Linux backup strategies and tools? tar archive files/directories, supports compression (gzip, bzip2, xz). rsync efficient incremental sync over SSH or local. dd raw disk/partition image backup. dump/restore filesystem-level backup for ext filesystems. Bacula/Amanda enterprise backup solutions. ``` $ tar czf backup.tar.gz /etc /home $ rsync -avz --delete /data/ backup@server:/backup/ $ dd if=/dev/sda of=/backup/sda.img bs=4M status=progress ``` ### 39. What is cron and how do you configure cron jobs? cron is the standard Unix job scheduler. User crontabs are edited with crontab -e. System-wide jobs go in /etc/crontab or /etc/cron.d/. The format is minute hour day-of-month month day-of-week command. ``` # m h dom mon dow command 0 2 * * * /usr/local/bin/backup.sh */5 * * * * /usr/bin/check_disk.sh $ crontab -e # edit user crontab $ crontab -l # list crontab $ sudo crontab -l -u root ``` ### 40. What is anacron and how does it differ from cron? anacron runs missed jobs after a system downtime ideal for laptops and desktops that are not always on. Unlike cron, anacron specifies a delay period (days) rather than exact times. Config is in /etc/anacrontab. ``` # /etc/anacrontab # period delay job-id command 1 5 daily /etc/cron.daily/ 7 10 weekly /etc/cron.weekly/ ``` ### 41. What is BIND and what are its main configuration files? BIND (Berkeley Internet Name Domain) is the most widely deployed DNS server. Key files /etc/named.conf or /etc/bind/named.conf (main config), /var/named/ or /etc/bind/ (zone files). The named daemon handles DNS queries. ``` $ sudo systemctl enable --now named $ named-checkconf /etc/named.conf $ named-checkzone example.com /var/named/example.com.zone ``` ### 42. What are DNS record types? A maps hostname to IPv4 address. AAAA maps hostname to IPv6 address. CNAME canonical name alias. MX mail exchanger with priority. NS nameserver for the zone. PTR reverse DNS (IP to hostname). SOA Start of Authority, zone metadata. TXT arbitrary text (SPF, DKIM, verification). SRV service location records. ### 43. What is a DNS SOA record? The SOA (Start of Authority) record is the first record in a zone file. It contains the primary nameserver, admin email (@ replaced by .), serial number (incremented on changes), refresh, retry, expire, and minimum TTL values. ``` @ IN SOA ns1.example.com. admin.example.com. ( 2024010101 ; Serial 3600 ; Refresh 900 ; Retry 604800 ; Expire 300 ) ; Minimum TTL ``` ### 44. What is a DNS zone transfer and how do you secure it? A zone transfer (AXFR) replicates zone data from a primary to a secondary nameserver. Restrict transfers using allow-transfer in named.conf to only permit known secondary nameserver IPs. Use TSIG (Transaction Signature) keys for authenticated transfers. ``` # named.conf zone "example.com" { type master; file "/var/named/example.com.zone"; allow-transfer { 192.168.1.2; }; }; ``` ### 45. What is DNSSEC? DNSSEC (DNS Security Extensions) adds cryptographic signatures to DNS records, allowing resolvers to verify authenticity and integrity. It prevents DNS spoofing and cache poisoning. Zone signing uses dnssec-keygen and dnssec-signzone or automated tools like rndc. ### 46. What is the difference between a recursive and authoritative DNS server? An authoritative DNS server holds the actual zone records and answers queries for its own zones. A recursive DNS resolver queries other nameservers on behalf of clients and caches results. A server can be both, but production DNS servers should separate these roles for security. ### 47. How do you troubleshoot DNS with dig and nslookup? dig is the preferred DNS troubleshooting tool it shows full query details. nslookup is simpler and interactive. Use +trace to follow the full resolution chain from root servers. ``` $ dig example.com A $ dig example.com MX $ dig @8.8.8.8 example.com # query specific server $ dig +trace example.com # full resolution chain $ dig -x 8.8.8.8 # reverse lookup ``` ### 48. What is Apache HTTP Server and its key configuration files? Apache (httpd) is the world's most used web server. Key files /etc/httpd/conf/httpd.conf (RHEL) or /etc/apache2/apache2.conf (Debian), /etc/httpd/conf.d/*.conf or /etc/apache2/sites-enabled/ for virtual hosts. Use apachectl configtest to validate config. ``` $ sudo apachectl configtest $ sudo apachectl graceful # reload without dropping connections $ sudo apachectl -M # list loaded modules ``` ### 49. What is an Apache virtual host? Virtual hosts allow a single Apache server to serve multiple websites. Name-based virtual hosts differentiate sites by the HTTP Host header; IP-based use different IP addresses. Define in /etc/apache2/sites-available/ and enable with a2ensite. ``` ServerName www.example.com ServerAlias example.com DocumentRoot /var/www/example ErrorLog ${APACHE_LOG_DIR}/example_error.log ``` ### 50. What is Nginx and how does it differ from Apache? Nginx is a high-performance web server and reverse proxy using an event-driven, asynchronous architecture. Unlike Apache's process/thread-per-connection model, Nginx handles thousands of concurrent connections with minimal memory. It excels as a reverse proxy, load balancer, and static file server. ### 51. What is an Nginx server block? Nginx server blocks (equivalent to Apache virtual hosts) define how Nginx handles requests for a domain. Config files go in /etc/nginx/sites-available/ and are symlinked to sites-enabled/. Use nginx -t to test configuration. ``` server { listen 80; server_name example.com www.example.com; root /var/www/example; index index.html; location / { try_files $uri $uri/ =404; } } ``` ### 52. What is a reverse proxy and how is it configured in Nginx? A reverse proxy receives client requests and forwards them to backend servers, hiding the backend from clients. Used for load balancing, SSL termination, and caching. In Nginx, use the proxy_pass directive. ``` server { listen 80; server_name api.example.com; location / { proxy_pass http://127.0.0.1:3000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; } } ``` ### 53. What is Let's Encrypt and Certbot? Let's Encrypt is a free, automated Certificate Authority providing SSL/TLS certificates. Certbot is the official client that automates certificate issuance and renewal for Apache and Nginx. Certificates are valid for 90 days and auto-renewed by a cron/systemd timer. ``` $ sudo certbot --nginx -d example.com -d www.example.com $ sudo certbot renew --dry-run ``` ### 54. What is Squid and what is it used for? Squid is a caching proxy server for HTTP, HTTPS, and FTP. It reduces bandwidth usage and improves response times by caching frequently requested content. It also provides access control, content filtering, and can be used as a forward or reverse proxy. ### 55. What is Samba and what protocols does it implement? Samba implements the SMB/CIFS protocol, allowing Linux to share files and printers with Windows systems and join Active Directory domains. It provides file sharing (smbd), NetBIOS name resolution (nmbd), and AD integration (winbindd). ``` # /etc/samba/smb.conf [shared] path = /srv/samba/shared writable = yes valid users = @sambausers $ sudo testparm # validate config $ sudo systemctl restart smbd nmbd ``` ### 56. What is the difference between NFS and Samba? NFS (Network File System) is a Unix/Linux native protocol optimized for Linux-to-Linux file sharing. Samba implements SMB/CIFS for cross-platform sharing with Windows. NFS is faster in homogeneous Linux environments; Samba is necessary for Windows interoperability. ### 57. What is vsftpd and how do you secure it? vsftpd (Very Secure FTP Daemon) is a lightweight FTP server for Linux. Security best practices disable anonymous access, use FTPS (FTP over TLS), chroot users to their home directories (chroot_local_user=YES), and use pasv_min/max_port for passive mode through firewalls. ``` # /etc/vsftpd.conf anonymous_enable=NO local_enable=YES write_enable=YES chroot_local_user=YES ssl_enable=YES ``` ### 58. What is DHCP and how do you configure a DHCP server on Linux? DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses to clients. ISC DHCP server (dhcpd) is configured in /etc/dhcp/dhcpd.conf. Define subnets, ranges, and static assignments. Kea DHCP is the modern replacement. ``` # /etc/dhcp/dhcpd.conf subnet 192.168.1.0 netmask 255.255.255.0 { range 192.168.1.100 192.168.1.200; option routers 192.168.1.1; option domain-name-servers 8.8.8.8; default-lease-time 86400; } ``` ### 59. What is PAM (Pluggable Authentication Modules)? PAM is a framework that decouples authentication from applications. Services (SSH, sudo, login) use PAM via /etc/pam.d/ config files. PAM modules provide authentication (pam_unix, pam_ldap), account management, session setup, and password policy enforcement. ``` # /etc/pam.d/sshd auth required pam_unix.so account required pam_nologin.so session required pam_limits.so ``` ### 60. What is LDAP and how is it used for Linux authentication? LDAP (Lightweight Directory Access Protocol) is a protocol for accessing directory services (user accounts, groups). Linux clients use SSSD (System Security Services Daemon) to authenticate against LDAP or Active Directory, caching credentials for offline access. ``` $ sudo authconfig --enableldap --enableldapauth \ --ldapserver=ldap://ldap.example.com \ --ldapbasedn="dc=example,dc=com" --update ``` ### 61. What are the components of a Linux email system? MTA (Mail Transfer Agent) transfers mail between servers via SMTP. Examples: Postfix, Exim, Sendmail. MDA (Mail Delivery Agent) delivers mail to a user's mailbox. Examples: Procmail, Dovecot LDA. MUA (Mail User Agent) client to read/send mail. Examples: mutt, Thunderbird. MRA (Mail Retrieval Agent) retrieves mail via IMAP/POP3. Examples: Dovecot, Courier. ### 62. What is Postfix and its key configuration files? Postfix is the most widely used Linux MTA. Key files /etc/postfix/main.cf (primary config), /etc/postfix/master.cf (process configuration), /etc/postfix/virtual (virtual alias maps). Use postconf to query/set parameters and postfix check to validate config. ``` $ sudo postconf myhostname $ sudo postconf -e "relayhost=[smtp.gmail.com]:587" $ sudo postfix check $ sudo postqueue -p # view mail queue ``` ### 63. What is Dovecot? Dovecot is an open-source IMAP and POP3 server for Linux. It delivers mail stored in Maildir or mbox format to MUA clients. It integrates with Postfix for local delivery, supports SSL/TLS, and handles authentication via PAM, LDAP, or SQL. ### 64. What are SPF, DKIM, and DMARC? SPF (Sender Policy Framework) DNS TXT record listing authorized mail servers for a domain. Prevents spoofing. DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing messages. Receiving servers verify the signature against a DNS public key. DMARC policy that specifies what to do when SPF/DKIM fail (none, quarantine, reject) and requests aggregate reports. ### 65. What is iptables and how does it work? iptables is the classic Linux firewall tool controlling packet filtering, NAT, and port forwarding via netfilter kernel hooks. Traffic passes through tables (filter, nat, mangle) and chains (INPUT, OUTPUT, FORWARD). Rules are evaluated top-to-bottom; the first match wins. ``` $ sudo iptables -L -n -v # list rules $ sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT $ sudo iptables -A INPUT -j DROP # default deny $ sudo iptables-save > /etc/iptables/rules.v4 ``` ### 66. What is nftables and how does it differ from iptables? nftables is the modern replacement for iptables, combining filter, nat, and mangle in a single framework with a cleaner syntax, better performance, and atomic rule replacement. The nft command manages rules. Most distributions now use nftables as the default backend (firewalld uses it on RHEL 9). ``` $ sudo nft list ruleset $ sudo nft add rule inet filter input tcp dport 22 accept ``` ### 67. What is firewalld? firewalld is a dynamic firewall manager using zones and services to manage iptables/nftables rules without restarting. Zones define trust levels for network connections. The firewall-cmd tool manages rules; --permanent makes them persist across reboots. ``` $ sudo firewall-cmd --list-all $ sudo firewall-cmd --permanent --add-service=https $ sudo firewall-cmd --permanent --add-port=8080/tcp $ sudo firewall-cmd --reload ``` ### 68. What is fail2ban? fail2ban monitors log files for repeated failed authentication attempts and automatically bans offending IPs by adding iptables/nftables rules. Configured in /etc/fail2ban/jail.conf (or jail.local). Commonly used to protect SSH, Apache, and Postfix. ``` # /etc/fail2ban/jail.local [sshd] enabled = true maxretry = 5 bantime = 3600 findtime = 600 $ sudo fail2ban-client status sshd ``` ### 69. What is OpenVPN? OpenVPN is an open-source SSL/TLS VPN solution providing encrypted tunnels over UDP or TCP. It uses X.509 certificates for authentication (managed with EasyRSA). It supports site-to-site and remote access VPN configurations. ### 70. What is WireGuard? WireGuard is a modern, fast, and simple VPN protocol built into the Linux kernel (since 5.6). It uses state-of-the-art cryptography, has a minimal codebase (~4,000 lines), and is significantly faster than OpenVPN and IPsec. Config lives in /etc/wireguard/wg0.conf. ``` # /etc/wireguard/wg0.conf [Interface] PrivateKey = Address = 10.0.0.1/24 ListenPort = 51820 [Peer] PublicKey = AllowedIPs = 10.0.0.2/32 $ sudo wg-quick up wg0 ``` ### 71. What is SELinux? SELinux (Security-Enhanced Linux) is a mandatory access control (MAC) system that restricts what processes can do based on security policies, independent of file permissions. Modes enforcing (policy enforced), permissive (logs violations but does not block), disabled. ``` $ getenforce # show mode $ sudo setenforce 0 # set permissive (temp) $ sudo setenforce 1 # set enforcing (temp) # Persistent: edit /etc/selinux/config $ ausearch -m AVC -ts recent # view denials ``` ### 72. What is AppArmor? AppArmor is a Linux security module providing mandatory access control via profiles that restrict what files, capabilities, and network access a program can use. Profiles are stored in /etc/apparmor.d/. It is the default MAC system on Ubuntu/Debian (SELinux is default on RHEL). ``` $ sudo aa-status # show profile status $ sudo aa-complain /usr/sbin/nginx # complain mode $ sudo aa-enforce /usr/sbin/nginx # enforce mode ``` ### 73. What is SSH hardening best practices? Key hardening steps in /etc/ssh/sshd_config: PermitRootLogin no disable root SSH login. PasswordAuthentication no enforce key-based auth only. Port 2222 change default port (security through obscurity). AllowUsers mohammad whitelist specific users. MaxAuthTries 3 limit auth attempts. ClientAliveInterval 300 timeout idle sessions. Protocol 2 ensure SSHv2 only. ### 74. What is sudo security hardening? Edit /etc/sudoers with visudo only (syntax checking). Use %groupname for group rules. Restrict commands with NOPASSWD carefully. Use Defaults logfile for logging. Use Defaults requiretty to prevent sudo in scripts. Use Defaults passwd_timeout and timestamp_timeout to limit session time. ``` # /etc/sudoers (edit with visudo) %wheel ALL=(ALL:ALL) ALL mohammad ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx Defaults logfile="/var/log/sudo.log" Defaults requiretty ``` ### 75. What are common log files for security monitoring? /var/log/auth.log or /var/log/secure authentication events, sudo usage, SSH logins. /var/log/audit/audit.log SELinux AVC denials, syscall auditing. /var/log/faillog failed login attempts. journalctl -u sshd SSH daemon journal. last / lastb successful and failed login history. ``` $ sudo lastb | head -20 # failed logins $ sudo last | head -20 # successful logins $ sudo grep "Failed password" /var/log/auth.log ``` ### 76. What is the auditd framework? auditd is the Linux audit daemon that records security-relevant system events based on rules. auditctl adds rules (watch files, monitor syscalls). ausearch queries audit logs. aureport generates summary reports. Rules persist in /etc/audit/audit.rules. ``` $ sudo auditctl -w /etc/passwd -p wa -k passwd_changes $ sudo ausearch -k passwd_changes $ sudo aureport --auth # authentication report $ sudo aureport --failed # failed events ``` ### 77. What is OpenSSL and how do you generate a self-signed certificate? OpenSSL is a toolkit implementing SSL/TLS and general cryptography. Generate a private key and self-signed certificate with openssl req. For production, use Let's Encrypt or a commercial CA instead. ``` # Generate private key and self-signed cert (valid 365 days) $ openssl req -x509 -nodes -days 365 \ -newkey rsa:4096 \ -keyout /etc/ssl/private/server.key \ -out /etc/ssl/certs/server.crt \ -subj "/CN=example.com/O=MyOrg/C=JO" # Verify certificate $ openssl x509 -in server.crt -text -noout ```