Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

LPIC 2 Exam 2 > Server security > Flashcards

Server security Flashcards

Router config, ssh, openVPN and other security tasks

1
Q

Where can you find a list of services and associated ports?

A

/etc/services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Telnet shouldn’t be used for remote access nowadays, however it is still useful. How?

A

As a troubleshooting tool, to check ports are open. Also to check the response from the server when clients access the port - is the server giving away more information than is necessary?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which tool can check which ports are open, listening or have active connections.

A

netstat

netstat -ltn #listening tcp ports
netstat -lun #listening udp ports

the ss tool can also do this, but it is not covered in this exam.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is netcat (or nc)

A

a network tool that can listen and connect to ports over the network. It can also be used to do a rudimentary port scan e.g. to

nc -vz localhost 100-200

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How would you scan localhost for open TCP ports in the range 50 to 150 with nmap

A

nmap -sT -p 50-150 localhost

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How would you scan localhost for open UDP ports in the range 50 to 150 with nmap

A

nmap -sU -p 50-150 localhost

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How can you use nmap to try to identify the operating system on a machine on your network.

A

use nmap fingerprinting -A switch e.g.

nmap -A localhost

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is openvas (www.openvas.org)?

A

An opensource application that can detect vulnerabilities on your linux system. It receives network vulnerability updates (NVT) daily, so it is able to provide up-to-date testing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How would you install OpenVAS on Debian?

A

sudo apt-get install openvas-server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How would you install OpenVAs on Redhat

A

yum install openvas

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which port does the openvas tool webserver run on

A

Port 9392

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is fail2ban

A

An intrusion detection application that monitors log files and blocks IP addresses for failed authentication attempts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the fail2ban config file

A

The main config is jail.conf, user defined options in jail.local

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is SNORT

A

Snort is a network intrusion detection system. It is placed on the network where is can see all traffic and monitors the traffic for intrusion attempts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Snort has 3 modes, what are they

A
  1. Sniffer (dumps all packets to the network)
  2. Packet logger (logs all packets to a file)
  3. NIDS - Intrusion detection - reports intrusion attempts
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Where is the Snort config utility and what is it called?

A

/etc/snort/snort.conf

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the HOME_NET Snort variable used to define?

A

HOME_NET is used to defined the local network ranges to monitor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the EXTERNAL_NET Snort variable used to define?

A

EXTERNAL_NET is used to defined the external network ranges to monitor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Snort rules format?

A

action protocol address direction address options

e.g.
alert icmp any any -> 192.168.10.0/24 any (msg: “Ping traffic detected”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Snort rules can be quite complex - luckily there is a package of predefined snort rules called..

A

pulledpork

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is NAT?

A

Network address translation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

How does NAT help security?

A

It hides internal IP addresses from external networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the 3 IP ranges used for private IP addressing

A
  1. 0.0.0 - 10.255.255.255
  2. 16.0.0 - 172.31.255.255
  3. 168.0.0 - 192.168.255.255
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

IPv6 defines link local addresses as standard how do these addresses start?

A

fe80:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
The Linux kernal uses an internal process called {answer] to process network packets
chains
26
What are the 5 linux chains used to process packets in iptables
1. PREROUTING before decision making 2. INPUT packets destined for local system 3. FORWARD handles packets being forwarded 4. POSTROUTING handles packets being sent to remote after the FORWARD filter 5. OUTPUT handles packets output from the local system
27
What are the 3 types of tables in iptables?
1. FILTER - apply filter rules to allow or block 2. MANGLE - apply rules to change the packet 3. NAT - apply rules to change the address
28
iptables command-line option to add a new rule
-A
29
iptables command-line option to delete a rule
-D
30
iptables command-line option to remove a chain or all chains
-F
31
iptables command-line option to list a specifed chain or all chains
-L
32
iptables command-line option to set the default policy for a chain
-P
33
iptables command-line option to specify the table a rule applies to
-t
34
What are the possible options for a chains default policy?
ACCEPT (packets accepted) DROP (packets silently dropper) LOG (packet is logged and passed to next chain) REJECT (packet is not passed, and sender is notified)
35
What is this iptables command doing? | sudo iptables -t filter -P OUTPUT DROP
It sets the default policy to DROP on the filter table in the OUTPUT chain. (That is, if no other rules are matched, the packet is dropped)
36
What is this iptables command doing? | sudo iptables -A INPUT -s 10.0.1.25 -j REJECT
this adds a rule in the INPUT chain to Reject packets that have come from the source 10.0.1.25
37
How do you save your changes to iptables?
iptables-save > iptables.txt
38
How would you restore your iptables rules save in iptables.txt?
iptables-restore < iptables.txt
39
iptables rule option to specify a destination address
-d
40
iptables rule option to jump to a new chain
-g
41
iptables rule option to take an action (ACCEPT, DROP etc.)
-j
42
iptables rule option to match a protocol
-p
43
iptables rule option to match a source address
-s
44
iptables rule option to specify a source port
--sport | also specify -p protocol
45
iptables rule option to specify a destination port
--dport | also specify -- protocol
46
How would you check if your linux system is currently configured to forward IP packets?
cat /proc/sys/net/ipv4/ip_forward or cat /proc/sys/net/ipv6/conf/all/forwarding
47
How can you change your system to allow IP forwarding after a reboot?
IPv4: sysctl -w net.ipv4.ip_forward=1 IPv6: sysctl -w net.ipv6.conf.all.forwarding=1
48
What is RIP
Router Information Protocol - it provides a way for network routers to advise what networks they support. As Linux discovers new routes they are added to the routed program. They can be viewed on the command line with the route command.
49
What is the SSH Daemon config file called and where will you find it?
/etc/ssh/sshd_conf don't confuse with the client config file /etc/ssh/ssh_conf
50
Command to check the expiry date of a pem file
openssl x509 -enddate -noout -in file.pem
51
Openssh server config option to specify the encryption protocol level.
Protocol (Level 2 is most secure)
52
Openssh server config option to allow user authentication with passwords
PasswordAuthentication
53
Openssh server config option to allow user authentication with certificates
PubkeyAuthentication
54
Openssh server config option to specify a list of users allowed to use SSH
AllowUsers
55
Openssh server config option to specify a list of users not allowed to use SSH
DenyUsers
56
Openssh server config option to allow the root login account to login using SSH
PermitRootLogin
57
Openssh server config option to allow x client applications to use SSH
X11Forwarding
58
Openssh server config option to allow SSH tunnelling
AllowTcpForwarding
59
Openssh command to generate a public/private key pair
ssh-keygen e.g. ssh-keygen -q -t rsa -f ~/.ssh/id_rsa -C '' -N '' then copy to authorised keys: cat id_rsa.pub >> ~/.ssh/authorised_keys
60
command to install openvpn
Debian: apt-get install openvpn Redhat: yum install openvpn
61
Openvpn config option to specify additional configuration files
config
62
Openvpn config option to specify a virtual network device for the VPN tunnel
dev
63
Openvpn config option to create the VPN tunnel without a local network address or port
nobind
64
Openvpn config option to set the ip addresses of the local and remote points in the VPN tunnel
ifconfig
65
Openvpn config option to specify a static encryption key
secret
66
What are the two types of of encryption method used by openvpn?
static key encryption (both client & server use same key) public key encryption (both client & server createpublic/private key pair and share the public key)
67
openvpn command to generate a secret key to be used with static key encryption
openvpn-genkey-secret secret.key
68
here is an example openvpn config ``` dev tun ifconfig 192.168.10.10 10.0.10.1 keepalive 10 60 ping-timer-rem persist-tun persit-key secret secret.key ``` What is the local ip address of this machine? Is ths the server or client? is this static key encryption or public key?
ifconfig [local-IP] [remote-IP] therefore Local IP address is 192.169.10.10 Remote IP address is 10.0.10.1 It looks like a server config, as there is no mention of the remote VPN server. It has a secret definition - therefore, using static key encryption
69
here is an example openvpn config ``` remote vpnserver.lpicstudy.net dev tun ifconfig 10.0.10.1 192.168.10.10 keepalive 10 60 ping-timer-rem persist-tun persit-key secret secret.key ``` What is the local ip address of this machine? Is the the server or client? is this static key encryption or public key?
ifconfig [local-IP] [remote-IP] therefore Local IP address is 10.0.10.1 Remote IP address is 192.169.10.10 It looks like a server config, as we specify a remote vpn server. It has a secret definition - therefore, using static key encryption
70
How would you start openvpn on a linux server?
sudo openvpn serverconfigname.conf
71
How would you start openvpn on a linux client
sudo openvpn clientconfigname.conf
72
What are some of the resources you can use to keep up-to-date with current security issues?
www. us-cert.gov www. sans.org www. securityfocus.com (bugtraq mailing list)
73
The kernel syslog may contain messages that would be useful for an attacker trying to exploit your server. How would you restrict the dmesg command to privileged users?
With the kernel.dmesg_restrict option for the running system: sudo sysctl -w kernel.dmesg_restrict=1 to make the change permanent: echo 'kernel.dmesg_restrict=1' | sudo tee -a /etc/sysctl.conf

LPIC 2 Exam 2 (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions