LPIC-2 202-450 common mistakes
LPIC-2 202-450 · Understand the traps and how to avoid them.
Writing a zone file with a missing trailing dot on a fully qualified name (e.g. `www.example.com` instead of `www.example.com.`), so BIND appends the origin and creates `www.example.com.example.com`.
The trailing dot is the only signal that a name is absolute. Candidates practice with relative names like www and then hand-type the FQDN in NS/MX/CNAME records without carrying the dot convention over, and named-checkzone is not run before reload.
What to do instead
Adopt the habit of always terminating absolute names with a dot and run named-checkzone example.com /etc/bind/db.example.com before every rndc reload. When a record looks wrong, query it back with dig @localhost www.example.com A and inspect the ANSWER section for the doubled suffix.
Configuring a slave/secondary zone without an `allow-transfer` restriction or without the `also-notify`/NS entry pointing at the master, then assuming replication works without checking the SOA serial on the secondary.
Candidates focus on getting the master to answer queries and treat the secondary as an afterthought, forgetting that the secondary must be listed in the master's allow-transfer, that the zone must be declared type slave with a masters clause, and that the serial must increase for transfer to trigger.
What to do instead
On the master, set allow-transfer { <secondary-ip>; }; and confirm the secondary is in the NS set. On the secondary, declare type slave; masters { <master-ip>; }; file "/var/cache/bind/db.example.com";. Verify with dig @<secondary> SOA example.com and compare serials, and force a transfer with rndc retransfer example.com when testing.
Enabling a site in Apache with a VirtualHost block but leaving out `ServerName`, `DocumentRoot` permissions, or the `Listen` directive, then blaming DNS when the wrong site answers.
On Debian-family systems sites are enabled via a2ensite symlinks and on RHEL via conf.d includes; candidates enable the file but forget that the first-loaded vhost becomes the default for unmatched Host headers, and SELinux contexts on the DocumentRoot are not set.
What to do instead
Give each vhost an explicit ServerName and ServerAlias, confirm Listen 80 (and 443) exists once in the main config, and verify with apachectl -S that name-to-vhost mapping is correct. On RHEL check ls -Z on the document root and run restorecon -Rv after moving content.
Setting up TLS for a web server but forgetting that the certificate chain must include intermediates, or mixing the key and certificate order in the combined file expected by the server.
Candidates test with a self-signed cert or a browser that silently fetches intermediates via AIA, so the missing intermediate only surfaces for clients that do not chase AIA. nginx expects cert-then-chain in ssl_certificate, while Apache uses SSLCertificateFile plus SSLCertificateChainFile (or a combined file on newer versions).
What to do instead
Concatenate the leaf certificate followed by the intermediate(s) into the file the server reads, keep the private key separate, and validate with openssl s_client -connect host:443 -showcerts to see the full chain presented. Check key/cert modulus match with openssl x509 -noout -modulus versus openssl rsa -noout -modulus.
Configuring a Samba share that is visible but denies access, because the share-level `valid users`, filesystem permissions, and SELinux/AppArmor context were not aligned.
Samba access requires passing share definition, user authentication, Unix permission on the path, and mandatory access control. Candidates fix one layer (e.g. add valid users) and stop, while the underlying directory is owned by root with 0755 or carries the wrong SELinux type.
What to do instead
Work the layers in order: confirm the Samba user exists with smbpasswd -a or pdbedit -L, set valid users/write list in the share, chown/chmod the path for that group, and on RHEL run chcon -t samba_share_t or set the samba_share_t fcontext with semanage fcontext then restorecon. Test with smbclient -U user //host/share.
Exporting an NFS share to a client but omitting `no_root_squash` for a legitimate root-write use case, or forgetting to run `exportfs -ra` after editing `/etc/exports`.
Candidates edit /etc/exports and expect the change to take effect immediately; existing exports are not re-read until exportfs -ra or an nfs service reload. Root-squashing also silently turns root writes into nobody, which looks like a permission bug.
What to do instead
After every edit run exportfs -ra and verify with exportfs -v that the client and options are listed. Add no_root_squash (or better, all_squash with anonuid/anongid for controlled access) only where the requirement demands it, and confirm the client mount options with mount | grep nfs.
Building a DHCP scope that hands out a default gateway or DNS server the client cannot reach, or forgetting the `option domain-name-servers` line entirely, then debugging at the DNS layer.
ISC dhcpd requires explicit option routers and option domain-name-servers; there is no implicit inheritance from the server's own network config. Candidates test with a client that already has a cached lease and never see the missing option.
What to do instead
In subnet declarations set option routers, option domain-name-servers, and option subnet-mask explicitly, then validate with dhcpd -t -cf /etc/dhcp/dhcpd.conf. On the client release the old lease (dhclient -r then dhclient) and inspect the result with ip addr and ip route or the lease file.
Configuring a Postfix relay or submission path but leaving `mynetworks`, `inet_interfaces`, or SASL/STARTTLS unset, so mail is either rejected as relay or accepted from anyone.
Postfix's default mynetworks can be broad, and candidates copy a main.cf snippet without checking inet_interfaces, smtpd_relay_restrictions, or the smtpd_sasl_auth_enable/smtpd_tls_auth_only combination needed for authenticated submission on 587.
What to do instead
Set inet_interfaces = all (or the specific address), define mydestination and mynetworks narrowly, and for submission enable smtpd_sasl_auth_enable = yes, smtpd_tls_auth_only = yes, and smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination. Run postfix check and test with swaks --to [email protected] --server localhost:587 -tls.
Setting up Dovecot with a mail location that does not match the MTA's delivery path (e.g. Maildir vs mbox) or without the SASL socket Postfix expects, so authentication or mail retrieval fails.
Postfix delivers to home_mailbox or a virtual transport, while Dovecot reads mail_location; if the two disagree, mail is delivered to a directory Dovecot never scans. The Postfix-Dovecot SASL handoff also needs smtpd_sasl_type = dovecot and a matching smtpd_sasl_path socket.
What to do instead
Make the paths agree: set Postfix home_mailbox = Maildir/ and Dovecot mail_location = maildir:~/Maildir, or use a shared virtual mailbox base. For SASL, confirm smtpd_sasl_type = dovecot, smtpd_sasl_path = private/auth, and that Dovecot's auth service listens on that socket. Verify with doveadm auth test user and postconf -n.
Locking down a host with iptables/nftables or firewalld and forgetting to persist the rules or to allow established/related return traffic, so services work until reboot or fail on the first response packet.
Rules added with iptables -A are runtime-only unless saved; firewalld needs --permanent plus --reload. Candidates also add a DROP policy on INPUT without an ESTABLISHED,RELATED accept rule, which breaks replies to outbound connections.
What to do instead
Place -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT early in the chain, add service rules, then persist: iptables-save > /etc/iptables/rules.v4 (or nft list ruleset > /etc/nftables.conf), and for firewalld use firewall-cmd --permanent --add-service=... followed by firewall-cmd --reload. Reboot or reload to prove persistence.