LPIC-2 202-450: System Security

System Security covers packet filtering, OpenSSH hardening, and cryptographic tooling. The exam expects rules that work in order, services that stay reachable, and an understanding of key trust.

Core rules

• Netfilter rules are ordered; first match wins. A stateful host firewall sets default policies to DROP, permits loopback, accepts ESTABLISHED,RELATED, then opens required services. iptables -A INPUT -p tcp --dport 22 -j ACCEPT appends; -I inserts at the top. Persist with iptables-save/iptables-restore or distro tooling.
• Routing requires net.ipv4.ip_forward=1 and FORWARD rules plus NAT in the nat table. nftables uses tables, chains, and rules with ct state established,related accept.
• sshd_config: PermitRootLogin no, PasswordAuthentication no, AllowUsers, Port. Key auth needs ~/.ssh mode 700 and authorized_keys 600; ssh-keygen -t ed25519 creates keys.
• GPG: gpg --gen-key, --export, --import, --encrypt -r, --sign, --verify. Trust is separate from possession of a public key.

Worked example

Protect a web server: allow SSH only from 192.0.2.0/24, HTTP/HTTPS from anywhere, drop the rest. Commands: iptables -A INPUT -i lo -j ACCEPT; iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT; iptables -A INPUT -s 192.0.2.0/24 -p tcp --dport 22 -j ACCEPT; iptables -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT; iptables -P INPUT DROP. Reasoning: allow loopback and established replies first, then the services, and set the default policy last so the active SSH session is not cut off.

Traps

Applying DROP before allowing your SSH session locks you out; putting the stateful rule after a broad drop blocks replies; forgetting FORWARD/NAT on a router; IPv6 remains open if only iptables is configured; SSH rejects keys with group/world-readable permissions; and importing a GPG key does not automatically trust it.