I85PREP
⌘ K
LFCE study materials
LFCE study resources

LFCE: Service Configuration and Security

LFCE · Work through your exam, one topic at a time.

All guide sections

Service Configuration and Security

What this domain covers

This domain pairs service deployment with the controls that decide whether it actually works: SELinux labeling and booleans, firewalld, TLS configuration, SSH hardening, sudo and PAM policy, auditd, and systemd sandboxing directives.

Core rules

  • Virtual hosts: Apache uses <VirtualHost :443> blocks in /etc/httpd/conf.d/.conf; nginx uses server blocks. Validate with httpd -t or nginx -t and reload rather than restart in production.
  • SELinux file contexts must be set persistently: semanage fcontext -a -t httpd_sys_content_t '/srv/www(/.*)?' followed by restorecon -Rv /srv/www. Non-standard ports need semanage port -a -t http_port_t -p tcp 8081.
  • Booleans such as httpd_can_network_connect are toggled with setsebool -P; without -P the change is lost on reload. Denials are read with ausearch -m AVC -ts recent.
  • SSH hardening: PermitRootLogin no, PasswordAuthentication no, AllowGroups, and Match blocks for exceptions; test with sshd -t before restarting so you do not lock yourself out.
  • sudo policy lives in /etc/sudoers.d/ files validated with visudo -c; include Defaults use_pty. PAM stack order matters for pam_faillock and pam_sss.
  • auditd watches: -w /etc/passwd -p wa -k identity, queried with ausearch -k identity. systemd hardening uses NoNewPrivileges, ProtectSystem=strict, PrivateTmp, and CapabilityBoundingSet.

Worked example

Apache must serve /srv/www on port 8081. Steps: create the content, semanage fcontext -a -t httpd_sys_content_t '/srv/www(/.*)?', restorecon -Rv /srv/www, add Listen 8081 plus a vhost, semanage port -a -t http_port_t -p tcp 8081, firewall-cmd --permanent --add-port=8081/tcp && firewall-cmd --reload, then systemctl reload httpd. Any skipped step yields 403, connection refused, or a timeout respectively.

Traps that cost marks

Using chcon, which does not survive relabeling; setting SELinux permissive instead of fixing context; a firewall change without reload; editing /etc/sudoers directly; wrong certificate chain order in the TLS file.