I85PREP
⌘ K
CUNP study materials
CUNP study resources

CUNP: Network Services and Daemon Administration

CUNP · Work through your exam, one topic at a time.

All guide sections

Network Services and Daemon Administration

This domain tests running, supervising, and validating network daemons on Unix systems. CUNP questions often present a service that will not start, listens on the wrong address, or fails after a configuration change, and expect you to use service-manager and daemon-specific evidence.

Core rules and concepts

  • A daemon is a long-running process, usually detached from a terminal and supervised by init, systemd, runit, or another service manager.
  • systemd unit files define dependencies, execution, restart behavior, and socket activation. Socket activation lets systemd own the listening socket and start the service on demand.
  • Services should drop privileges after binding privileged ports and should run with the least identity that works.
  • Configuration validation before reload is mandatory when the daemon provides a test mode, such as sshd -t or nginx -t.
  • Reload and restart are different. Reload asks the daemon to reread configuration; restart replaces the process and may drop connections.
  • Logs are evidence. Use journalctl -u unit, the daemon's own log, and the system syslog facility. Check timestamps and exit status.
  • SELinux or AppArmor can deny bind, read, or connect operations even when Unix permissions look correct.

Worked example

sshd fails after an edit. Run sshd -t to catch syntax errors. If it passes, check whether another process owns port 22 with ss -ltnp, inspect journalctl -u sshd for exit codes, and verify host-key files and their permissions. If the unit starts then immediately exits, read the last journal lines rather than restarting repeatedly. A reload may be enough for an authorized_keys change, but a changed ListenAddress or Port normally needs a restart and a firewall review.

Traps that cost marks

Do not assume a running process is healthy just because the unit is active. Do not use restart as a diagnostic loop. Check the actual bind address: 127.0.0.1 is not reachable from remote hosts. Remember that a config test may not cover every runtime dependency, and that a firewall can block a correctly listening daemon.

Exam focus

Validate configuration, inspect the listening socket, read logs, and confirm the service identity and security context.