LPIC-3 Security flashcards
LPIC-3 Security · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- LUKS header
- The LUKS header stores encryption parameters, key slots, and the master key encrypted by each passphrase. `cryptsetup luksDump` displays it; losing all passphrases makes data unrecoverable.
- HMAC
- A keyed hash construction that authenticates a message and verifies integrity using a shared secret. It does not encrypt data, so confidentiality requires a separate cipher.
- Perfect forward secrecy
- A property where compromise of long-term keys does not reveal past session keys. It requires ephemeral Diffie-Hellman key exchange such as DHE or ECDHE, not static RSA.
- openssl verify
- A command that validates a certificate chain against a trusted CA file. `openssl verify -CAfile ca.pem cert.pem` reports OK only if the signature and chain are valid.
- GPG key export
- `gpg --export -a KEYID` writes an ASCII-armored public key suitable for sharing. Private keys are exported separately with `--export-secret-keys` and must be protected.
- PBKDF2 in OpenSSL
- The `-pbkdf2` option derives a key from a passphrase with many iterations, slowing brute-force attacks. Without it, older OpenSSL used a weaker, faster derivation.
- SELinux enforcing mode
- A mode where the kernel denies access that policy forbids and logs the denial as an AVC. `setenforce 1` enables it at runtime; `getenforce` reports the current mode.
- restorecon
- A command that resets file SELinux contexts to the values defined by policy. `restorecon -Rv /path` recurses and shows changes; it undoes temporary `chcon` modifications.
- auditctl watch rule
- A rule that logs access to a path. `auditctl -w /etc/passwd -p wa -k passwd_changes` logs writes and attribute changes, tagged with the key for later `ausearch` queries.
- pam_faillock
- A PAM module that locks an account after a configured number of failed authentication attempts. It records failures per user and is configured in the service's PAM stack.
- AIDE baseline
- A database of file hashes and metadata created with `aide --init`. Later `aide --check` runs compare the live filesystem to this baseline and report modifications, additions, and deletions.
- AppArmor complain mode
- A profile mode that logs policy violations without blocking them. `aa-complain` switches a profile to this mode for troubleshooting; `aa-enforce` restores blocking behavior.
- systemd NoNewPrivileges
- A unit setting that prevents a service and its children from gaining new privileges through setuid or file capabilities. It reduces the impact of a compromised service process.
- setgid directory
- A directory with the setgid bit where newly created files inherit the directory's group instead of the creator's primary group. It is common for shared project directories.
- sticky bit
- A permission bit on a directory that lets only a file's owner, the directory owner, or root delete or rename it. It is typically set on /tmp to prevent interference.
- POSIX ACL mask
- An ACL entry that caps the effective permissions of named users, named groups, and the owning group. `getfacl` shows it as `mask::`; `setfacl` recalculates it unless `-n` is used.
- Default ACL
- An ACL set on a directory with `setfacl -d` that is inherited by newly created files and subdirectories. It controls initial permissions rather than access to the directory itself.
- chattr +i
- An attribute that makes a file immutable: it cannot be modified, deleted, renamed, or linked even by root until the attribute is removed with `chattr -i`. `lsattr` displays it.
- File capabilities
- Per-file privileges granted without full setuid, set with `setcap cap_net_bind_service+ep`. `getcap` lists them; they let a binary perform specific privileged operations only.
- umask 077
- A mask that removes all group and other permissions, producing files with mode 600 and directories with 700. It is used where data must remain private to the owner.
- conntrack states
- Connection tracking states used in firewall rules: NEW for the first packet, ESTABLISHED for replies, RELATED for associated connections, and INVALID for unrecognized packets.
- DNAT
- Destination NAT rewrites the destination address and port of packets, typically in the nat PREROUTING chain, to forward external traffic to an internal host.
- nftables hook input
- A base chain attached to the input hook processes packets destined for the local host. Its policy, often drop, sets the default verdict for unmatched packets.
- HSTS header
- A response header instructing browsers to use HTTPS only for a period. `Strict-Transport-Security: max-age=31536000; includeSubDomains` prevents protocol downgrade attacks.
- SSH PermitRootLogin no
- An sshd setting that blocks direct root logins over SSH, forcing administrators to log in as a normal user and escalate. It reduces exposure to root password brute force.
- WireGuard key pair
- A Curve25519 private/public key pair generated with `wg genkey` and `wg pubkey`. Peers exchange public keys; the private key stays on the host and must be protected.
- nmap SYN scan
- `nmap -sS` sends TCP SYN packets and infers open ports from SYN-ACK replies without completing the handshake. It requires root privileges and is stealthier than a connect scan.
- hosts.allow precedence
- TCP wrappers evaluate /etc/hosts.allow before /etc/hosts.deny, and the first matching rule decides. An allow entry therefore overrides a later deny entry for the same client.
- CVSS base score
- A 0.0-10.0 severity rating derived from exploitability and impact metrics. Ranges are none, low (0.1-3.9), medium (4.0-6.9), high (7.0-8.9), and critical (9.0-10.0).
- CVE identifier
- A unique public identifier for a specific disclosed vulnerability, formatted as CVE-YEAR-NUMBER. It enables tracking and cross-referencing across scanners and advisories.
- OpenVAS
- An open-source vulnerability scanner, now part of Greenbone, that runs network tests against hosts and produces reports with severity ratings and remediation guidance.
- rkhunter --check
- A command that scans the local system for rootkits, suspicious files, and altered binaries. It compares hashes to known-good values and reports warnings that require manual verification.