LPIC-2 202-450 key terms

A text file that declares the resource records for one DNS zone, including its SOA and NS records plus address and service entries. BIND loads it via a zone statement in named.conf.

The Start of Authority record, mandatory first record in a zone. It names the primary server, the responsible mailbox, and timer values controlling serial numbers, refresh, retry, expiry, and negative caching.

A single entry in a zone file pairing a name, class, type, and data, such as A, AAAA, CNAME, MX, or TXT. Each type has its own data format and placement rules.

An alias record mapping one name to another canonical name. The aliased name must not also hold other record types, and a CNAME cannot coexist with an MX or NS at the same owner name.

A mail exchanger record that lists a host accepting mail for a domain, preceded by a preference number. Lower numbers are tried first, and the target must be a name with an address record, not a CNAME.

A pointer record used in reverse zones to map an IP address back to a hostname. Reverse zones are named after reversed address octets, such as 1.168.192.in-addr.arpa.

A DNS zone holding PTR records for a block of addresses, keyed by reversed IP octets under in-addr.arpa or ip6.arpa. Delegation of these zones is usually controlled by the address owner.

The SOA value that secondary servers compare to detect zone changes. It must increase on every edit; common conventions are date-based counters like YYYYMMDDnn to avoid forgetting the increment.

Copying a whole zone from a primary to a secondary server, usually over TCP. AXFR transfers the entire zone while IXFR sends only changes since a known serial number.

A BIND options or zone statement listing which addresses may request zone transfers. Restricting it to known secondaries prevents outsiders from downloading the full contents of your zones.

A BIND statement controlling which clients may send ordinary DNS queries. Tightening it on authoritative servers limits cache snooping and reduces exposure to reflection abuse.

A resolver's behavior of chasing referrals to find a final answer on behalf of a client. Authoritative-only servers should disable it to avoid being used in amplification attacks.

A server that a resolver sends queries to instead of resolving from the root. Configured with the forwarders statement, often paired with forward only to skip iterative lookups.

The built-in or file-supplied list of root server addresses a resolver starts from when resolving iteratively. BIND ships a named.root file refreshed by the root.zone package.

A BIND feature serving different zone data to different client groups, chosen by match-clients. Common uses are split-horizon DNS giving internal clients private addresses and external clients public ones.

A shared-secret mechanism that signs DNS messages with HMAC to authenticate transfers and dynamic updates. The key name and algorithm must match on both peers and be declared with the key statement.

Runtime addition or removal of records through the UPDATE opcode rather than editing files. BIND permits it only where an allow-update statement names trusted keys or addresses.

A binary file beside a zone file recording dynamic changes so BIND can replay them after restart and serve incremental transfers. Its name is set by the zone's file plus .jnl.

A BIND utility that parses a zone file and reports syntax or semantic errors such as missing SOA records or out-of-zone names before the server loads it.

The remote name daemon control utility that talks to BIND over a keyed control channel. It reloads zones, flushes caches, and reports server status without restarting the daemon.

An Apache directive block that groups configuration for a specific address, port, or hostname. Name-based virtual hosts rely on the Host header and need ServerName plus matching DNS.

An Apache directive declaring the hostname a virtual host answers to. It also feeds self-referential redirects, so a wrong value causes redirects to the wrong site.

The Apache directive naming the directory whose contents are served for a virtual host. Access control is applied separately with Directory blocks and requires matching filesystem permissions.

The Apache 2.4 authorization directive replacing Allow and Deny. Forms include Require all granted, Require ip 192.0.2.0/24, and Require valid-user for authenticated access.

A utility creating and updating the password file used for HTTP basic authentication. Options add users, set bcrypt hashes with -B, and delete entries, and the file must sit outside the document root.

The Apache module providing HTTPS. It reads SSLCertificateFile and SSLCertificateKeyFile and enables per-host TLS settings inside virtual host blocks listening on port 443.

An Apache directive pointing to the PEM-encoded server certificate, optionally with intermediate certificates appended. The private key is named separately by SSLCertificateKeyFile.

The nginx equivalent of a virtual host, defined with a server directive containing listen and server_name. Multiple blocks on one address are selected by the requested hostname.

An nginx directive matching request URIs by prefix, exact string, or regular expression. It applies proxying, rewriting, or access rules to the matched paths and nests inside a server block.

A front-end web server that forwards requests to back-end application servers and returns their responses. nginx uses proxy_pass, while Apache uses mod_proxy with ProxyPass and ProxyPassReverse.

A persistent protocol connecting a web server to application processes such as PHP-FPM. Apache uses mod_proxy_fcgi with SetHandler, and nginx uses fastcgi_pass plus fastcgi_param.

A directory or printer exported to SMB clients through a smb.conf section. Options set the path, browseability, write access, and valid users for that share.

The main Samba configuration file, divided into a global section and one section per share. It controls workgroup membership, security mode, logging, and per-share permissions.

A Samba utility that checks smb.conf syntax and prints the resulting configuration. Running it after edits catches unknown parameters before restarting smbd.

A Samba tool for managing SMB account passwords in its own database, separate from Linux passwords. It can add users, change passwords, and enable or disable accounts.

An entry in /etc/exports granting a client host or subnet access to a directory, with options like rw, ro, sync, and root_squash. Changes take effect after exportfs -ra.

The NFS administration command that lists current exports, re-reads /etc/exports with -ra, and removes or adds individual exports without restarting the server.

An NFS export option mapping the client's root user to the anonymous account, preventing remote root from owning exported files. no_root_squash disables this and is rarely safe.

The time-limited assignment of an address to a client, tracked by the DHCP server in its lease database. Renewal happens at half the lease time, and expiry frees the address for reuse.

The ISC DHCP server configuration file with global options, subnet declarations, and host or pool blocks. It defines address ranges, routers, DNS servers, and lease times.

A host forwarding client DHCP broadcasts to a server on another subnet as unicast. It is configured with dhcrelay or the relay agent feature of a router.

Network booting where a client gets an address by DHCP, then fetches a bootloader over TFTP. DHCP options name the boot file and next server, enabling automated OS installation.

The primary Postfix configuration file holding parameters such as myhostname, mydestination, relayhost, and mynetworks. Changes are applied with postfix reload or a service restart.

The Postfix utility that prints or edits main.cf parameters. With -n it shows only non-default settings, and with -e it changes a value in place.

A Postfix parameter naming the smarthost that outbound mail is forwarded through. It is often used when the local host cannot deliver directly to destination MX servers.

A Postfix parameter listing client addresses allowed to relay mail through the server without authentication. An overly broad value turns the host into an open relay.

A mechanism letting mail clients prove identity, usually via Dovecot or Cyrus, so submission on port 587 can require credentials before relaying. Postfix enables it with smtpd_sasl_auth_enable.

A mail delivery and IMAP/POP3 server. It can also provide SASL authentication for Postfix and uses its own configuration tree under /etc/dovecot.

A mailbox format storing each message as a separate file in cur, new, and tmp subdirectories. It avoids locking issues of mbox and is commonly used by Dovecot.

A DNS TXT policy listing which hosts may send mail for a domain. Receivers check the sending IP against it, and results feed spam scoring and rejection decisions.

A signing scheme where the sender adds a cryptographic signature header and publishes the public key in DNS. Receivers verify that signed headers and body were not altered.

A DNS policy that tells receivers how to handle mail failing SPF or DKIM alignment, and where to send reports. It also requires a matching From domain.

The classic Linux packet filter interface, organizing rules into tables and chains such as INPUT and FORWARD. Rules match on addresses, ports, and connection state.

The modern kernel packet filtering framework replacing iptables, configured with the nft command. It uses tables, chains, and sets with a unified syntax for IPv4 and IPv6.

A firewall management daemon using zones that group interfaces and permitted services. It supports runtime and permanent configuration, with firewall-cmd applying changes.

A service that watches log files for repeated authentication failures and temporarily adds firewall rules blocking the offending addresses. Jails define which logs and actions apply.

A legacy access control layer using /etc/hosts.allow and /etc/hosts.deny to permit or refuse connections to services compiled with libwrap support, such as older sshd builds.

A public and private key used for passwordless SSH authentication. The public half goes into the remote authorized_keys file, and the private half stays protected locally.

The SSH daemon configuration file controlling listening ports, permitted authentication methods, root login, and per-user or per-group restrictions. It is validated with sshd -t before reload.

A public/private key pair used for signing and encrypting data or email. Keys are managed with gpg, exported and imported, and protected by a passphrase.