I85PREP
⌘ K
LPIC-1 102-500 study materials
LPIC-1 102-500 study resources

LPIC-1 102-500: Security

LPIC-1 102-500 · Work through your exam, one topic at a time.

All guide sections

Security

What the exam tests

Security covers host hardening, user and sudo policy, SSH, file permissions, and encryption. The exam tests command syntax and the security consequence of configuration choices.

Core rules

  • Find risky permissions: find / -xdev -perm -4000 -type f lists SUID files; -perm -2000 finds SGID. Review them because SUID root binaries can elevate privilege. /etc/shadow should be mode 640 or 600 and owned by root:shadow or root:root depending on distro.
  • sudo policy is edited with visudo, never directly. A rule such as %admins ALL=(ALL:ALL) ALL grants the group commands as any user and group. NOPASSWD: removes the password prompt but weakens accountability. su - starts a login shell; su keeps the environment more nearly.
  • PAM and limits: /etc/security/limits.conf and /etc/security/limits.d/ set nofile, nproc, and similar limits via pam_limits; ulimit -a shows the current shell's limits.
  • SSH: generate keys with ssh-keygen -t ed25519; copy with ssh-copy-id; ~/.ssh/authorized_keys must not be group/world writable. Harden /etc/ssh/sshd_config with PermitRootLogin no and PasswordAuthentication no, then reload sshd.
  • Encryption: GnuPG handles file and email encryption: gpg --encrypt --recipient, --decrypt, --sign, and --verify. LUKS uses cryptsetup luksFormat, luksOpen, mkfs, and mount; persist with /etc/crypttab and /etc/fstab.

Worked example

Audit SUID binaries and handle an unexpected one: find / -xdev -perm -4000 -type f -print Suppose /usr/local/bin/helper appears. Check it with ls -l and rpm -qf or dpkg -S. If it is unowned and not required, remove the SUID bit with chmod u-s /usr/local/bin/helper. Reasoning: -xdev avoids crossing filesystems; -perm -4000 means all SUID bits set. Removing s reduces privilege without deleting the file.

Traps

Use visudo; a syntax error can make sudo unusable. Order and negation (!) matter in sudoers, so test with sudo -l. chmod 777 is not a fix. SSH key permissions are enforced. cryptsetup luksFormat destroys existing data. TCP Wrappers rules in /etc/hosts.allow are checked before /etc/hosts.deny.