LPIC-2 202-450 cheat sheet

BIND zone file SOA record fields in order: MNAME (primary NS), RNAME (admin email with dot for @), SERIAL, REFRESH, RETRY, EXPIRE, MINIMUM (negative TTL).

A zone is authoritative for its data; recursion is a separate service. In named.conf, recursion yes; with allow-recursion { 192.0.2.0/24; }; limits who may use the resolver.

DNSSEC signing: dnssec-keygen -a RSASHA256 -b 2048 -n ZONE example.com creates KSK/ZSK; dnssec-signzone -o example.com -k KSK example.com.zone produces .signed zone. Publish DS at parent.

TSIG key for secure zone transfers: tsig-keygen -a hmac-sha256 transfer-key >> /etc/bind/named.conf.key; reference with allow-transfer { key transfer-key; }; and server x { keys { transfer-key; }; };

rndc reload reloads all zones; rndc reload example.com reloads one zone; rndc reconfig reloads named.conf and new zones; rndc flush clears cache.

Zone file serial must increase on every change; use YYYYMMDDnn format. Secondary checks SOA serial and transfers via AXFR/IXFR when master serial is higher.

View clauses: view "internal" { match-clients { 10.0.0.0/8; }; recursion yes; zone "example.com" { type master; file "internal.db"; }; }; each view needs its own zone statements.

named-checkconf /etc/bind/named.conf validates configuration; named-checkzone example.com /etc/bind/db.example.com validates zone syntax and reports serial.

CNAME records cannot coexist with other record types at the same name and cannot point to the zone apex; use DNAME for subtree redirection or A/AAAA for apex.

Apache virtual host: <VirtualHost *:80> ServerName example.com DocumentRoot /var/www/example ; requires NameVirtualHost or default catch-all; first matching ServerName/Alias wins.

Apache SSL: LoadModule ssl_module; Listen 443; SSLEngine on SSLCertificateFile /etc/ssl/certs/site.crt SSLCertificateKeyFile /etc/ssl/private/site.key .

Apache access control: <Directory /var/www> Require ip 192.0.2.0/24 (2.4); older Order deny,allow / Allow from / Deny from syntax is 2.2.

Apache rewrite: RewriteEngine On; RewriteRule ^/old/(.)$ /new/$1 [R=301,L]; RewriteCond %{HTTPS} off; RewriteRule (.) https://%{HTTP_HOST}$1 [R=301,L].

nginx server block: server { listen 80; server_name example.com; root /var/www/example; location / { try_files $uri $uri/ =404; } }.

nginx reverse proxy: location / { proxy_pass http://127.0.0.1:8080; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; }.

nginx TLS: listen 443 ssl; ssl_certificate /etc/ssl/certs/site.crt; ssl_certificate_key /etc/ssl/private/site.key; ssl_protocols TLSv1.2 TLSv1.3;.

Apache modules: a2enmod rewrite ssl headers; a2dismod; a2ensite/a2dissite manage sites-enabled symlinks; apachectl configtest validates before reload.

PHP-FPM with nginx: location ~ .php$ { include fastcgi_params; fastcgi_pass unix:/run/php/php8.2-fpm.sock; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; }.

Samba share in smb.conf: [share] path = /srv/share browseable = yes read only = no valid users = @staff; then testparm and systemctl reload smbd.

Samba user database is separate from Linux: smbpasswd -a user adds; pdbedit -L lists; smbclient -L //server -U user lists shares.

Samba security modes: security = user (default, local auth), security = ads (Active Directory domain member via net ads join), security = domain (NT4-style).

NFS export line: /srv/nfs 192.0.2.0/24(rw,sync,no_subtree_check,root_squash); exportfs -ra re-reads /etc/exports; showmount -e server lists exports.

NFSv4 uses a pseudo-filesystem rooted at /export; exportfs -v shows active exports; rpcinfo -p server lists registered RPC services.

NFS mount options: vers=4.2, rw, hard vs soft, intr, noatime; /etc/fstab entry server:/srv/nfs /mnt nfs4 defaults,_netdev 0 0.

Samba global options: workgroup, server string, log file, max log size, map to guest = bad user, unix password sync = yes.

NFS id mapping with idmapd: /etc/idmapd.conf Domain = example.com; NFSv4 uses user@domain strings; nfsidmap -c clears the keyring cache.

Samba share-level permissions combine with filesystem permissions: filesystem perms are authoritative; share perms act as a mask. Use chmod/chown and setfacl for fine control.

DHCP subnet declaration: subnet 192.0.2.0 netmask 255.255.255.0 { range 192.0.2.100 192.0.2.200; option routers 192.0.2.1; option domain-name-servers 192.0.2.53; default-lease-time 600; max-lease-time 7200; }.

DHCP static reservation: host printer { hardware ethernet 00:11:22:33:44:55; fixed-address 192.0.2.50; } inside the subnet block; dhcpd -t validates config.

DHCP failover: primary and secondary peers use failover peer "name" { primary/secondary; address; port; max-response-delay; mclt; split; } and reference in shared-network.

PXE boot chain: DHCP provides next-server (TFTP IP) and filename (pxelinux.0); client fetches bootloader and config from TFTP; kernel/initrd served over TFTP or HTTP.

NTP client: /etc/chrony.conf server ntp.example.com iburst; chronyc sources -v; chronyc tracking; timedatectl set-ntp true enables systemd-timesyncd or chronyd.

NTP server: allow 192.0.2.0/24 in chrony.conf; local stratum 10 when no upstream; ntpq -p shows peers and stratum for classic ntpd.

LDAP client: /etc/ldap/ldap.conf sets BASE, URI; nsswitch.conf passwd: files ldap; PAM via pam_ldap or sssd; getent passwd user verifies NSS lookup.

SSSD for LDAP/AD: /etc/sssd/sssd.conf [domain/example.com] id_provider = ldap auth_provider = ldap ldap_uri = ldap://server; systemctl restart sssd; sss_cache -E clears cache.

DHCP relay: dhcrelay -i eth0 192.0.2.10 forwards client requests to a DHCP server on another subnet; or use ip helper-address on routers.

Postfix main.cf core: myhostname, mydomain, myorigin, inet_interfaces, mydestination, relayhost, home_mailbox = Maildir/; postfix check and postconf -n verify.

Postfix transport maps: transport_maps = hash:/etc/postfix/transport; entry example.com smtp:[mail.example.com]:587; postmap /etc/postfix/transport after edits.

Postfix virtual domains: virtual_mailbox_domains, virtual_mailbox_maps, virtual_mailbox_base, virtual_uid_maps, virtual_gid_maps; virtual aliases via virtual_alias_maps.

SASL auth for submission: smtpd_sasl_auth_enable = yes, smtpd_sasl_type = dovecot, smtpd_sasl_path = private/auth, smtpd_tls_auth_only = yes; port 587 in master.cf with smtpd_tls_security_level = encrypt.

Dovecot IMAP: protocols = imap lmtp; mail_location = maildir:~/Maildir; passdb { driver = pam }; userdb { driver = passwd }; 10-mail.conf, 10-auth.conf, 10-ssl.conf.

Dovecot LMTP for Postfix delivery: service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { mode = 0600 user = postfix group = postfix } } and mailbox_transport = lmtp:unix:private/dovecot-lmtp.

SPF record: v=spf1 mx ip4:192.0.2.0/24 -all; DKIM signing in OpenDKIM (KeyTable, SigningTable, Domain) with postfix milter via smtpd_milters = inet:localhost:8891.

DMARC policy record: _dmarc.example.com TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]; pct=100"; p=none for monitoring, p=reject for enforcement.

Mail queue commands: mailq or postqueue -p lists; postqueue -f flushes; postsuper -d ALL deletes; postcat -q QUEUEID shows message content.

iptables default policy: iptables -P INPUT DROP; iptables -P FORWARD DROP; iptables -P OUTPUT ACCEPT; allow loopback: iptables -A INPUT -i lo -j ACCEPT; allow established: -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT.

iptables rule order matters: first match wins; insert with -I at top, append with -A; save with iptables-save > /etc/iptables/rules.v4; restore with iptables-restore.

nftables: nft add table inet filter; nft add chain inet filter input { type filter hook input priority 0; policy drop; }; nft add rule inet filter input ct state established,related accept; nft list ruleset.

firewalld: firewall-cmd --permanent --add-service=https; firewall-cmd --reload; --add-port=8080/tcp; --add-source=192.0.2.0/24 --zone=trusted; zones define trust levels.

SELinux modes: enforcing, permissive, disabled in /etc/selinux/config; getenforce/setenforce; sestatus -v shows contexts; ausearch -m AVC -ts recent for denials.

SELinux file contexts: semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"; restorecon -Rv /web; chcon is temporary and lost on relabel.

SELinux booleans: getsebool -a; setsebool -P httpd_can_network_connect on; semanage boolean -l lists persistent values.

AppArmor: aa-status lists profiles; aa-enforce /etc/apparmor.d/usr.sbin.nginx; aa-complain sets complain mode; apparmor_parser -r reloads a profile.

OpenSSH hardening: PermitRootLogin no, PasswordAuthentication no, PubkeyAuthentication yes, AllowUsers user, Port 2222 in sshd_config; sshd -t tests config; fail2ban watches auth log.