LPIC-2 202-450 flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

SOA record fields

Start of Authority contains MNAME (primary nameserver), RNAME (admin email with dot), SERIAL, REFRESH, RETRY, EXPIRE, and MINIMUM (negative caching TTL). Serial increments on every zone change.

rndc reload vs reconfig

rndc reload reloads zone data for all zones. rndc reconfig reloads named.conf and any newly added zones without dropping existing zone data. rndc flush clears the resolver cache.

DNSSEC key signing

dnssec-keygen -a RSASHA256 -b 2048 -n ZONE example.com creates KSK and ZSK pairs. dnssec-signzone -o example.com -k KSK example.com.zone produces the signed zone; the DS record is published at the parent.

BIND views

A view clause matches clients by match-clients and serves different zone files per client set. Each view must contain its own zone statements; recursion settings can differ per view.

TSIG zone transfer key

tsig-keygen -a hmac-sha256 name creates a shared secret. Reference it in allow-transfer { key name; }; on the master and server ip { keys { name; }; }; on the secondary to authenticate AXFR/IXFR.

CNAME restrictions

A CNAME cannot coexist with any other record type at the same name and cannot exist at the zone apex. Use A/AAAA at the apex or DNAME for subtree redirection.

Apache virtual host

A <VirtualHost *:80> block with ServerName, DocumentRoot, and optional Alias serves a site. The first matching ServerName or Alias wins; unmatched requests hit the first defined vhost.

Apache Require directive

Apache 2.4 access control uses Require ip 192.0.2.0/24, Require host, or Require all granted inside <Directory> or <Location>. The 2.2 Order/Allow/Deny syntax is deprecated.

Apache RewriteRule flags

RewriteRule pattern substitution [R=301,L] issues a permanent redirect and stops processing. RewriteCond tests variables such as %{HTTPS} or %{HTTP_HOST} before the rule applies.

nginx try_files

try_files $uri $uri/ =404 checks each path in order and serves the first existing file, falling back to the last argument. It is commonly used to route requests to index.php or return 404.

nginx reverse proxy headers

proxy_pass forwards to an upstream. proxy_set_header Host $host and X-Real-IP $remote_addr preserve the original host and client IP for the backend application.

a2ensite and a2enmod

a2ensite creates symlinks in sites-enabled for a site config; a2enmod enables Apache modules. a2dissite and a2dismod disable them. apachectl configtest validates before reload.

Samba smbpasswd

smbpasswd -a user adds a Samba account and prompts for a password stored in the Samba database, separate from /etc/shadow. pdbedit -L lists Samba users.

Samba security modes

security = user authenticates against local Samba accounts. security = ads joins an Active Directory domain via net ads join. security = domain uses an NT4-style domain controller.

NFS export options

/etc/exports lines specify client and options such as rw, sync, no_subtree_check, and root_squash. exportfs -ra re-reads exports; showmount -e server lists them.

NFSv4 pseudo-filesystem

NFSv4 exports form a single namespace rooted at /export. Clients mount server:/export/share. rpcinfo -p lists RPC services; NFSv4 uses only port 2049.

idmapd domain

/etc/idmapd.conf sets Domain = example.com for NFSv4 name mapping. Users are represented as user@domain. nfsidmap -c clears the keyring cache after changes.

DHCP fixed-address

A host block with hardware ethernet MAC and fixed-address IP inside a subnet reserves a lease for a client. dhcpd -t validates the configuration before restart.

DHCP failover split

A failover peer block defines primary and secondary with address, port, max-response-delay, mclt, and split. The split value (often 128) divides free leases between peers.

PXE boot sequence

DHCP supplies next-server and filename (pxelinux.0). The client fetches the bootloader and config from TFTP, then loads kernel and initrd via TFTP or HTTP.

chrony iburst

server ntp.example.com iburst in chrony.conf sends a burst of packets at startup for fast synchronization. chronyc sources -v shows peers; chronyc tracking shows offset and stratum.

SSSD LDAP provider

sssd.conf [domain/example.com] sets id_provider = ldap and auth_provider = ldap with ldap_uri. nsswitch.conf must list sss for passwd and group. sss_cache -E clears the cache.

Postfix transport_maps

transport_maps = hash:/etc/postfix/transport maps destinations to next-hop transports such as smtp:[mail.example.com]:587. Run postmap on the file after editing.

Postfix virtual mailbox

virtual_mailbox_domains lists hosted domains; virtual_mailbox_maps maps addresses to Maildir paths; virtual_uid_maps and virtual_gid_maps set ownership. virtual_alias_maps forwards addresses.

Postfix SASL submission

smtpd_sasl_auth_enable = yes with smtpd_sasl_type = dovecot and smtpd_sasl_path = private/auth enables authenticated submission on port 587, usually with smtpd_tls_security_level = encrypt.

Dovecot mail_location

mail_location = maildir:~/Maildir defines per-user Maildir storage. protocols = imap lmtp enables IMAP and LMTP. passdb and userdb blocks configure authentication and user lookup.

SPF record syntax

A TXT record v=spf1 mx ip4:192.0.2.0/24 -all authorizes sending hosts. -all rejects unauthorized senders; ~all marks them softfail. Only one SPF record per domain is allowed.

DMARC policy record

_dmarc.example.com TXT with v=DMARC1; p=quarantine; rua=mailto:[email protected] sets policy and reporting. p=none monitors, p=reject enforces; pct limits the percentage applied.

postqueue and postsuper

postqueue -p lists the mail queue; postqueue -f flushes it. postsuper -d ALL deletes all queued messages; postcat -q QUEUEID displays a message. mailq is an alias for postqueue -p.

iptables conntrack rule

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT permits return traffic for allowed outbound connections. Place it before DROP rules to keep responses flowing.

firewalld permanent changes

firewall-cmd --permanent --add-service=https writes to the persistent config; --reload applies it. Without --permanent the change is runtime-only and lost on reload.

SELinux fcontext and restorecon

semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?" adds a persistent file context rule. restorecon -Rv /web applies it. chcon changes are temporary and lost on relabel.