LinuC Level 2 Exam 202Study guide

Learn to configure and operate a DHCP server that auto-assigns IP addresses to clients: dhcpd (the ISC DHCP server) and its config file dhcpd.conf, the lease-state file dhcpd.leases, using arp to verify results, checking logs via syslog/the systemd journal, and distributing IPv6 router advertisements with radvd and radvd.conf.

Learn PAM (Pluggable Authentication Modules), which makes Linux authentication swappable: the per-service config directory /etc/pam.d/ and the legacy single-file pam.conf, nsswitch.conf which orders name resolution, sssd.conf for external directory integration, and the key modules pam_unix, pam_cracklib, pam_limits, pam_listfile, and pam_sss.

Learn the basic commands for operating an LDAP directory server from a client: ldapadd to add entries, ldapdelete to remove them, ldapmodify to change attributes, ldapsearch to search, and ldappasswd to change passwords.

Learn to configure and operate the OpenLDAP server daemon (slapd) itself: slapcat, slapadd, and slapindex for backing up, importing, and reindexing the database, the data directory /var/lib/ldap/, the dynamic-configuration mechanism slapd-config, access control defined via slapd.access, and the core directory concepts DN, LDIF, and objectClass/attributes.

Learn the layout of BIND's (named) core config file named.conf, and the query/operations tools dig, host, nslookup, rndc, and named-checkconf. Also cover where lightweight alternatives dnsmasq, Unbound, NSD, and PowerDNS fit in.

Learn the layout of a zone file and the format of common resource records (SOA, NS, A, AAAA, MX, CNAME, PTR). Also cover named-compilezone and named-checkzone for converting and checking zone files.

Learn DNS server hardening: a chroot jail, restricting forwarders, DNSSEC signing and validation (dnssec-keygen, dnssec-signzone), TSIG for message integrity, and DANE for binding certificates to DNS.

Learn to configure and operate the Apache HTTP Server (httpd/apache2): the httpd.conf file, control via apachectl/apache2ctl, access and error logs, hosting multiple sites with virtual hosts, per-directory overrides via .htaccess, Basic authentication with mod_auth_basic, mod_authz_host, AuthUserFile, AuthGroupFile, and htpasswd, and URL forwarding with Redirect.

Learn to enable HTTPS on Apache with OpenSSL: where certificates and keys live (/etc/ssl/, /etc/pki/), enabling SSL/TLS with SSLEngine, specifying the certificate and key via SSLCertificateFile and SSLCertificateKeyFile, controlling protocol and cipher choice with SSLProtocol and SSLCipherSuite, specifying CA certificates with SSLCACertificateFile and SSLCACertificatePath, and manipulating keys/certificates with the openssl command.

Learn nginx basics and its use as a reverse proxy: the configuration directory /etc/nginx/, control via the nginx command, enabling HTTPS with the ssl directives (ssl_certificate, ssl_certificate_key, ssl_ciphers, ssl_protocols), forwarding to a backend with proxy_pass, and tuning proxy behavior with proxy_http_version and proxy_set_header.

Learn the basics of Squid, a forward proxy software: its configuration file squid.conf, the squidclient tool for testing, the http_access directive that controls access, and acl (access control lists) that define its conditions.

Learn how Postfix (an MTA) is configured: the split between /etc/postfix/main.cf (runtime parameters) and master.cf (service/daemon definitions), address rewriting via /etc/aliases, the queue layout under /var/spool/postfix/, checking logs, SMTP authentication (SASL) and TLS encryption, the basics of the SMTP protocol, and where exim fits as an alternative MTA.

Learn to configure Dovecot (an MRA, mail retrieval agent): the configuration layout under /etc/dovecot/ and dovecot.conf, the verification command doveconf, the administration command doveadm, the difference between POP3 and IMAP, and encryption via TLS.

Learn to configure and manage Samba for sharing files and printers with Windows clients: the /etc/samba/smb.conf configuration file, the roles of the smbd, nmbd, and winbindd daemons, syntax validation with testparm, managing Samba users with smbpasswd, operational monitoring with smbstatus and smbcontrol, client-side operations and AD integration via smbclient, net, and samba-tool, and user mapping plus ACL management with getfacl/setfacl.

Learn to configure and manage NFS for sharing filesystems among Unix/Linux clients: the export definition file /etc/exports, applying it with exportfs, checking exports from a client with showmount, monitoring activity with nfsstat, checking RPC services with rpcinfo, the roles of mountd and the portmapper, and mount options plus persistence/verification via /etc/fstab and /proc/mounts.

Learn packet filtering with iptables/ip6tables and the higher-level firewalld (firewall-cmd) and ufw. Cover kernel parameters under /proc/sys/net/ipv4///proc/sys/net/ipv6/, the routing table, port redirection, /etc/services, and persisting rules with iptables-save/iptables-restore.

Learn sshd configuration via /etc/ssh/sshd_config: host keys (/etc/ssh/ssh_host_*_key/ssh_host_*_key.pub), controlling root login with PermitRootLogin, public key auth with PubkeyAuthentication, restricting users with AllowUsers, and PasswordAuthentication.

Learn the fundamentals of VPN (Virtual Private Network) and the open-source implementation OpenVPN: the configuration directory /etc/openvpn/, the openvpn command used by both server and client, and the difference between the two common topologies, point-to-point and site-to-site.

Learn the tools of day-to-day security operations: connectivity/scanning with netcat(nc/ncat) and nmap, packet filtering with iptables/firewalld, vulnerability advisory sources Bugtraq, CERT, and CIAC, intrusion prevention with fail2ban, the intrusion detection system (IDS) snort, and vulnerability scanners OpenVAS/OpenSCAP.

Learn the mindset behind systems that keep running: failure patterns (physical, logical, planned maintenance) and eliminating SPoF (single point of failure); the meaning and distinctions among MTBF, MTTR, availability, SLA, RPO, and RTO; and achieving resiliency through redundancy, clustering (Pacemaker, Corosync), load balancing, and geographic distribution.

Learn the mindset behind capacity planning for future load growth, and the difference between scale up/down (vertical) and scale out/in (horizontal). Understand the prerequisite for scaling out—a stateless design that externalizes databases and sessions—plus automating machine reconfiguration with configuration management tools and VM images, and distributing load with a load balancer or DNS round robin.

Learn how to architect systems on IaaS (Infrastructure as a Service): the difference between ephemeral storage and persistent storage, fixed IP vs floating IP, isolation via tenant networks, traffic control with firewalls and security groups, object storage, messaging systems/queues, and automatic node adjustment via an autoscaler.

Learn the recurring reference architectures: the components of LAMP and LAPP (Linux + Apache + MySQL/MariaDB or PostgreSQL + PHP/Perl/Python); the three-tier web model (the roles of the web server, application server, and database server); redundant designs combining a load balancer with HA configuration, database replication, and scale-out; speeding things up with a proxy server, cache, and CDN; and asynchronous data processing via a message queue.