LPIC-3 Security cheat sheet

OpenSSL symmetric encryption: openssl enc -aes-256-cbc -pbkdf2 -salt -in plain -out cipher; decryption uses -d with the same passphrase, cipher, and parameters.

Asymmetric key sizes: RSA minimum 2048 bits (3072 recommended), ECDSA P-256 or P-384 for TLS, Ed25519 for signatures; DSA is deprecated.

Hashing: SHA-256/SHA-3 are current; MD5 and SHA-1 are broken for collision resistance and must not be used for signatures or certificates.

GPG: gpg --full-generate-key creates a key pair; gpg --export -a KEYID exports public key; gpg --import adds a key; gpg --sign/--encrypt/--verify/--decrypt operate on files.

X.509: a certificate binds a public key to an identity and is signed by a CA; openssl x509 -in cert.pem -text -noout displays fields; openssl verify -CAfile ca.pem cert.pem checks the chain.

Perfect forward secrecy requires ephemeral key exchange (DHE/ECDHE); static RSA key exchange does not provide PFS.

LUKS: cryptsetup luksFormat /dev/sdX initializes; cryptsetup luksOpen maps; cryptsetup luksDump shows header; cryptsetup luksAddKey adds a passphrase slot.

HMAC combines a hash with a secret key for message authentication; it is not encryption and does not provide confidentiality.

Randomness: /dev/urandom is the general-purpose CSPRNG on Linux; /dev/random may block and is not required for key generation on modern kernels.

SELinux modes: enforcing (denies and logs), permissive (logs only), disabled; getenforce/sestatus show mode; setenforce 0|1 toggles enforcing/permissive at runtime.

SELinux contexts are shown by ls -Z; restorecon -Rv /path resets files to policy-default contexts; chcon makes temporary changes that restorecon will revert.

AppArmor profiles live in /etc/apparmor.d/; aa-status lists loaded/enforcing profiles; aa-complain sets a profile to complain mode; aa-enforce restores enforcement.

Auditd: rules in /etc/audit/rules.d/*.rules; auditctl -w /etc/passwd -p wa -k passwd_changes watches writes/attribute changes; ausearch -k passwd_changes queries the log.

PAM: /etc/pam.d/ holds service stacks; control flags include required, requisite, sufficient, optional; pam_tally2/pam_faillock implement account lockout after failed logins.

sudo policy is in /etc/sudoers and /etc/sudoers.d/; edit with visudo; %group ALL=(ALL) ALL grants group members full sudo.

Systemd hardening directives include NoNewPrivileges=yes, ProtectSystem=strict, PrivateTmp=yes, RestrictAddressFamilies=, and CapabilityBoundingSet=.

File integrity: AIDE builds a baseline database with aide --init and checks with aide --check; changes are reported by hash, permissions, and metadata.

Kernel hardening: sysctl kernel.dmesg_restrict=1, kernel.kptr_restrict=2, net.ipv4.conf.all.rp_filter=1, and fs.protected_hardlinks=1 reduce information leaks and attack surface.

Traditional Unix permissions: read=4, write=2, execute=1; chmod 750 file sets rwxr-x---; the first digit is setuid/setgid/sticky (4/2/1).

Special bits: setuid (s) runs a program as the file owner; setgid (s) on a directory makes new files inherit the directory group; sticky (t) restricts deletion in shared directories.

umask is subtracted from default permissions: umask 022 yields files 644 and directories 755; umask 077 yields 600/700.

POSIX ACLs: setfacl -m u:alice:rw file grants user alice rw; getfacl file displays entries; the mask limits effective permissions of named users/groups and group class.

Default ACLs on a directory (setfacl -d -m u:alice:rwx dir) are inherited by newly created files and subdirectories.

Extended attributes: getfattr/setfattr manage xattrs; lsattr/chattr +i makes a file immutable (cannot be modified, deleted, or renamed even by root until -i).

Capabilities: getcap/setcap cap_net_bind_service+ep /usr/bin/prog grants a specific privilege without full setuid; capsh --print shows the current process capability set.

sudo timestamp caching is controlled by timestamp_timeout in sudoers; Defaults targetpw requires the target user's password instead of the caller's.

iptables filter table chains: INPUT, OUTPUT, FORWARD; default policy DROP plus explicit ACCEPT rules implements least privilege; iptables -L -n -v lists rules with counters.

Stateful matching uses -m conntrack --ctstate NEW,ESTABLISHED,RELATED; allowing ESTABLISHED,RELATED is required for return traffic when the default policy is DROP.

NAT: SNAT/MASQUERADE rewrite source addresses in the nat POSTROUTING chain; DNAT rewrites destination addresses in PREROUTING for port forwarding.

nftables replaces iptables: nft add table inet filter, nft add chain inet filter input { type filter hook input priority 0\; policy drop\; }, then nft add rule.

TLS hardening: disable TLS 1.0/1.1 and SSLv3; prefer ECDHE cipher suites; set HSTS with Strict-Transport-Security: max-age=31536000; includeSubDomains.

SSH hardening: PermitRootLogin no, PasswordAuthentication no, PubkeyAuthentication yes, AllowUsers/AllowGroups, and Protocol 2; host keys in /etc/ssh/ssh_host_*.

WireGuard is a UDP-based VPN using Curve25519 keys; wg genkey/wg pubkey create key pairs; peers are configured in /etc/wireguard/*.conf.

Port scanning: nmap -sS (SYN scan, requires root), -sT (TCP connect), -sU (UDP), -sV (version detection), -O (OS detection).

TCP wrappers use /etc/hosts.allow and /etc/hosts.deny; the first matching rule wins, and allow is evaluated before deny.

CVSS base score ranges: 0.0 none, 0.1-3.9 low, 4.0-6.9 medium, 7.0-8.9 high, 9.0-10.0 critical; the vector string encodes attack vector, complexity, privileges, and impact.

CVE identifiers are assigned per vulnerability; NVD enriches them with CVSS scores and CPE applicability; CWE classifies the underlying weakness type.

nmap --script vuln runs NSE vulnerability scripts; nmap -sV identifies service versions that are then matched to known CVEs.

OpenVAS/Greenbone: gvm-setup initializes the scanner; gvm-start launches services; scans produce reports with severity ratings and remediation advice.

Lynis audits host hardening and reports a hardening index; lynis audit system runs a local assessment.

rkhunter --check and chkrootkit scan for rootkits; rkhunter --update refreshes signatures; false positives must be verified before acting.

Log analysis: journalctl -p err -b shows errors from the current boot; ausearch -m avc -ts recent finds SELinux denials; lastb shows failed logins.

File integrity monitoring detects tampering: AIDE or Tripwire baselines must be stored off-host so an attacker cannot rewrite the reference database.

Vulnerability management cycle: inventory assets, scan, prioritize by CVSS plus exposure, remediate or mitigate, then rescan to verify closure.