Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

LPIC 2 Exam 2 > Server security > Flashcards

Server security Flashcards

Router config, ssh, openVPN and other security tasks

1
Q

Where can you find a list of services and associated ports?

A

/etc/services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Telnet shouldn’t be used for remote access nowadays, however it is still useful. How?

A

As a troubleshooting tool, to check ports are open. Also to check the response from the server when clients access the port - is the server giving away more information than is necessary?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which tool can check which ports are open, listening or have active connections.

A

netstat

netstat -ltn #listening tcp ports
netstat -lun #listening udp ports

the ss tool can also do this, but it is not covered in this exam.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is netcat (or nc)

A

a network tool that can listen and connect to ports over the network. It can also be used to do a rudimentary port scan e.g. to

nc -vz localhost 100-200

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How would you scan localhost for open TCP ports in the range 50 to 150 with nmap

A

nmap -sT -p 50-150 localhost

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How would you scan localhost for open UDP ports in the range 50 to 150 with nmap

A

nmap -sU -p 50-150 localhost

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How can you use nmap to try to identify the operating system on a machine on your network.

A

use nmap fingerprinting -A switch e.g.

nmap -A localhost

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is openvas (www.openvas.org)?

A

An opensource application that can detect vulnerabilities on your linux system. It receives network vulnerability updates (NVT) daily, so it is able to provide up-to-date testing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How would you install OpenVAS on Debian?

A

sudo apt-get install openvas-server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How would you install OpenVAs on Redhat

A

yum install openvas

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which port does the openvas tool webserver run on

A

Port 9392

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is fail2ban

A

An intrusion detection application that monitors log files and blocks IP addresses for failed authentication attempts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the fail2ban config file

A

The main config is jail.conf, user defined options in jail.local

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is SNORT

A

Snort is a network intrusion detection system. It is placed on the network where is can see all traffic and monitors the traffic for intrusion attempts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Snort has 3 modes, what are they

A
  1. Sniffer (dumps all packets to the network)
  2. Packet logger (logs all packets to a file)
  3. NIDS - Intrusion detection - reports intrusion attempts
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Where is the Snort config utility and what is it called?

A

/etc/snort/snort.conf

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the HOME_NET Snort variable used to define?

A

HOME_NET is used to defined the local network ranges to monitor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the EXTERNAL_NET Snort variable used to define?

A

EXTERNAL_NET is used to defined the external network ranges to monitor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Snort rules format?

A

action protocol address direction address options

e.g.
alert icmp any any -> 192.168.10.0/24 any (msg: “Ping traffic detected”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Snort rules can be quite complex - luckily there is a package of predefined snort rules called..

A

pulledpork

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is NAT?

A

Network address translation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

How does NAT help security?

A

It hides internal IP addresses from external networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the 3 IP ranges used for private IP addressing

A
  1. 0.0.0 - 10.255.255.255
  2. 16.0.0 - 172.31.255.255
  3. 168.0.0 - 192.168.255.255
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

IPv6 defines link local addresses as standard how do these addresses start?

A

fe80:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

The Linux kernal uses an internal process called {answer] to process network packets

A

chains

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are the 5 linux chains used to process packets in iptables

A
  1. PREROUTING before decision making
  2. INPUT packets destined for local system
  3. FORWARD handles packets being forwarded
  4. POSTROUTING handles packets being sent to remote after the FORWARD filter
  5. OUTPUT handles packets output from the local system
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What are the 3 types of tables in iptables?

A
  1. FILTER - apply filter rules to allow or block
  2. MANGLE - apply rules to change the packet
  3. NAT - apply rules to change the address
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

iptables command-line option to add a new rule

A

-A

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

iptables command-line option to delete a rule

A

-D

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

iptables command-line option to remove a chain or all chains

A

-F

31
Q

iptables command-line option to list a specifed chain or all chains

A

-L

32
Q

iptables command-line option to set the default policy for a chain

A

-P

33
Q

iptables command-line option to specify the table a rule applies to

A

-t

34
Q

What are the possible options for a chains default policy?

A

ACCEPT (packets accepted)
DROP (packets silently dropper)
LOG (packet is logged and passed to next chain)
REJECT (packet is not passed, and sender is notified)

35
Q

What is this iptables command doing?

sudo iptables -t filter -P OUTPUT DROP

A

It sets the default policy to DROP on the filter table in the OUTPUT chain. (That is, if no other rules are matched, the packet is dropped)

36
Q

What is this iptables command doing?

sudo iptables -A INPUT -s 10.0.1.25 -j REJECT

A

this adds a rule in the INPUT chain to Reject packets that have come from the source 10.0.1.25

37
Q

How do you save your changes to iptables?

A

iptables-save > iptables.txt

38
Q

How would you restore your iptables rules save in iptables.txt?

A

iptables-restore < iptables.txt

39
Q

iptables rule option to specify a destination address

A

-d

40
Q

iptables rule option to jump to a new chain

A

-g

41
Q

iptables rule option to take an action (ACCEPT, DROP etc.)

A

-j

42
Q

iptables rule option to match a protocol

A

-p

43
Q

iptables rule option to match a source address

A

-s

44
Q

iptables rule option to specify a source port

A

–sport

also specify -p protocol

45
Q

iptables rule option to specify a destination port

A

–dport

also specify – protocol

46
Q

How would you check if your linux system is currently configured to forward IP packets?

A

cat /proc/sys/net/ipv4/ip_forward
or
cat /proc/sys/net/ipv6/conf/all/forwarding

47
Q

How can you change your system to allow IP forwarding after a reboot?

A

IPv4:
sysctl -w net.ipv4.ip_forward=1

IPv6:
sysctl -w net.ipv6.conf.all.forwarding=1

48
Q

What is RIP

A

Router Information Protocol - it provides a way for network routers to advise what networks they support.

As Linux discovers new routes they are added to the routed program. They can be viewed on the command line with the route command.

49
Q

What is the SSH Daemon config file called and where will you find it?

A

/etc/ssh/sshd_conf

don’t confuse with the client config file
/etc/ssh/ssh_conf

50
Q

Command to check the expiry date of a pem file

A

openssl x509 -enddate -noout -in file.pem

51
Q

Openssh server config option to specify the encryption protocol level.

A

Protocol (Level 2 is most secure)

52
Q

Openssh server config option to allow user authentication with passwords

A

PasswordAuthentication

53
Q

Openssh server config option to allow user authentication with certificates

A

PubkeyAuthentication

54
Q

Openssh server config option to specify a list of users allowed to use SSH

A

AllowUsers

55
Q

Openssh server config option to specify a list of users not allowed to use SSH

A

DenyUsers

56
Q

Openssh server config option to allow the root login account to login using SSH

A

PermitRootLogin

57
Q

Openssh server config option to allow x client applications to use SSH

A

X11Forwarding

58
Q

Openssh server config option to allow SSH tunnelling

A

AllowTcpForwarding

59
Q

Openssh command to generate a public/private key pair

A

ssh-keygen

e.g.
ssh-keygen -q -t rsa -f ~/.ssh/id_rsa -C ‘’ -N ‘’

then copy to authorised keys:

cat id_rsa.pub&raquo_space; ~/.ssh/authorised_keys

60
Q

command to install openvpn

A

Debian:
apt-get install openvpn
Redhat:
yum install openvpn

61
Q

Openvpn config option to specify additional configuration files

A

config

62
Q

Openvpn config option to specify a virtual network device for the VPN tunnel

A

dev

63
Q

Openvpn config option to create the VPN tunnel without a local network address or port

A

nobind

64
Q

Openvpn config option to set the ip addresses of the local and remote points in the VPN tunnel

A

ifconfig

65
Q

Openvpn config option to specify a static encryption key

A

secret

66
Q

What are the two types of of encryption method used by openvpn?

A

static key encryption (both client & server use same key)
public key encryption (both client & server createpublic/private key pair and share the public key)

67
Q

openvpn command to generate a secret key to be used with static key encryption

A

openvpn-genkey-secret secret.key

68
Q

here is an example openvpn config

dev tun
ifconfig 192.168.10.10 10.0.10.1
keepalive 10 60
ping-timer-rem
persist-tun
persit-key
secret secret.key

What is the local ip address of this machine?
Is ths the server or client?
is this static key encryption or public key?

A

ifconfig [local-IP] [remote-IP] therefore
Local IP address is 192.169.10.10
Remote IP address is 10.0.10.1

It looks like a server config, as there is no mention of the remote VPN server.

It has a secret definition - therefore, using static key encryption

69
Q

here is an example openvpn config

remote vpnserver.lpicstudy.net
dev tun
ifconfig 10.0.10.1 192.168.10.10
keepalive 10 60
ping-timer-rem
persist-tun
persit-key
secret secret.key

What is the local ip address of this machine?
Is the the server or client?
is this static key encryption or public key?

A

ifconfig [local-IP] [remote-IP] therefore
Local IP address is 10.0.10.1
Remote IP address is 192.169.10.10

It looks like a server config, as we specify a remote vpn server.

It has a secret definition - therefore, using static key encryption

70
Q

How would you start openvpn on a linux server?

A

sudo openvpn serverconfigname.conf

71
Q

How would you start openvpn on a linux client

A

sudo openvpn clientconfigname.conf

72
Q

What are some of the resources you can use to keep up-to-date with current security issues?

A

www. us-cert.gov
www. sans.org
www. securityfocus.com (bugtraq mailing list)

73
Q

The kernel syslog may contain messages that would be useful for an attacker trying to exploit your server. How would you restrict the dmesg command to privileged users?

A

With the kernel.dmesg_restrict option

for the running system:
sudo sysctl -w kernel.dmesg_restrict=1

to make the change permanent:
echo ‘kernel.dmesg_restrict=1’ | sudo tee -a /etc/sysctl.conf

LPIC 2 Exam 2 (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions