LPIC-3 Security key terms

A Linux disk-encryption format that stores keyslots, cipher settings, and metadata in a JSON header, supporting Argon2 key derivation and online re-encryption without reformatting the volume.

A kernel device-mapper target that transparently encrypts block devices, performing symmetric encryption on every read and write beneath the filesystem layer.

A memory-hard password-hashing function used to derive encryption keys from passphrases, deliberately expensive in RAM and CPU to frustrate brute-force and GPU-based attacks.

Repeated or deliberately slow derivation of a key from a weak passphrase, increasing the work an attacker must do for each guess during offline cracking.

A key-derivation standard that applies a pseudorandom function, usually HMAC, many times with a salt, producing keys from passwords at a configurable computational cost.

Random data stored alongside a hashed password or derived key so identical inputs produce different outputs, defeating precomputed rainbow tables and revealing duplicate passwords.

A secret value mixed into password hashing but kept separate from the stored hash, typically in application configuration, so a database leak alone does not permit offline cracking.

The traditional Unix password-hashing interface whose modular format prefixes hashes with identifiers such as $6$ for SHA-512 or $y$ for yescrypt, selecting algorithm and parameters.

A memory-hard password-hashing scheme and the default in modern Linux shadow suites, designed to resist GPU and ASIC cracking while remaining tunable for cost.

A signed data structure binding a public key to an identity, carrying validity dates, issuer, subject, key usage, and extensions, validated by chaining to a trusted root.

An ordered set of certificates from an end-entity certificate through intermediate authorities to a trusted root, each link verifying the signature of the one below it.

An online protocol where a client asks a responder whether a specific certificate has been revoked, returning good, revoked, or unknown status for that serial number.

A TLS server fetches a signed OCSP response and presents it during the handshake, sparing clients a separate revocation lookup and improving privacy and latency.

A time-stamped, issuer-signed list of revoked certificate serial numbers published at a distribution point, which clients download and cache to check revocation.

Hard-coding or configuring an expected certificate, public key, or CA so a client rejects any other chain, limiting damage from a compromised or mis-issuing authority.

A decentralized model where users sign each other's public keys to vouch for identity, with trust computed by following signature paths rather than relying on central authorities.

The act of cryptographically signing another party's public key with your own, asserting you have verified their identity and adding an edge to the trust graph.

Publishing a signed statement that a key pair is no longer valid, often using a pre-generated revocation certificate, so peers stop encrypting to or trusting that key.

A modular framework letting applications delegate authentication, account checks, session setup, and password changes to stacked, configurable modules in files under /etc/pam.d.

A PAM module that counts consecutive failed authentications per account and temporarily locks it after a threshold, throttling online password guessing.

A PAM module enforcing password complexity rules such as minimum length, character classes, dictionary checks, and similarity to the old password during changes.

A policy that disables or delays authentication for an account after repeated failures, trading resistance to guessing against the risk of denial of service.

A host intrusion-detection tool that records hashes and metadata of files in a database and reports additions, deletions, and modifications when the filesystem is later checked.

Continuously or periodically comparing file hashes and attributes against a known-good baseline to detect tampering with binaries, configuration, and critical system files.

The Linux audit daemon that records security-relevant system calls and events according to rules, writing detailed logs useful for forensics and compliance evidence.

A specification loaded into the kernel audit subsystem defining which syscalls, file accesses, or events to record, matched by path, syscall number, or field filters.

A kernel audit setting, enabled by a flag in audit.rules, that prevents rules from being changed until reboot, blocking attackers from blinding logging on a live system.

A mandatory access control mechanism where every process and object carries a type, and policy rules explicitly allow domains to access only permitted types.

The label on a process or file composed of user, role, type, and level, consulted by the kernel on every access decision and set persistently with tools like semanage.

An access vector cache message logged when SELinux blocks an operation, showing source and target contexts plus the denied permission class, used to diagnose or tune policy.

A named on/off policy switch that toggles predefined behavior, such as allowing a service to bind a network port, without writing custom policy modules.

A per-program path-based confinement policy listing allowed file accesses, capabilities, and network operations, loaded into the kernel to restrict that executable.

An extension to traditional Unix permissions adding access entries for individual named users and groups, with mask and default entries controlling effective rights.

A per-process bitmask subtracted from default creation modes, determining which permission bits new files and directories do not receive.

A directory whose group ID is inherited by new files and subdirectories, commonly used to keep shared project trees consistently group-owned.

The modern Linux packet-filtering framework replacing iptables, using tables, chains, sets, and a unified rule syntax evaluated by the kernel netfilter hooks.

The kernel connection-tracking subsystem that records flow state so firewalls can match established, related, new, and invalid packets rather than inspecting every packet statelessly.

A denial-of-service attack sending many half-open TCP handshakes to exhaust a server's connection table, mitigated with SYN cookies and rate limits.

Restricting how many events, connections, or packets are accepted per source or interval, blunting brute-force guessing, floods, and resource exhaustion.

A modern in-kernel VPN using public-key peers, a small set of modern ciphers, and simple configuration files, offering fast handshakes and a minimal attack surface.

An open-source IPsec implementation supporting IKEv2, certificate and pre-shared-key authentication, and flexible policy configuration on Linux gateways and road-warrior clients.

A network-layer security architecture using AH or ESP to authenticate and encrypt IP packets, with IKE negotiating security associations between peers.

A publicly catalogued identifier for a specific disclosed vulnerability, giving a stable name that scanners, advisories, and trackers use to refer to the same flaw.

A standardized scoring system rating vulnerability severity from metrics such as attack vector, complexity, privileges required, and impact, producing a numeric base score.

A tool that inventories software versions and configuration on hosts or networks, matches them against vulnerability data, and reports findings with severity and remediation hints.

An open-source vulnerability scanning framework with network vulnerability tests and feeds, commonly driven through the Greenbone management interface.

Both are file-integrity baselines; the distinction is tooling and licensing, not concept, so candidates should know either records hashes and metadata for later comparison.

A service that watches log files for patterns of failed authentication and inserts temporary firewall bans for offending addresses, reducing repeated online attacks.

Logging in by proving possession of a private key whose public half is authorized on the server, avoiding password transmission and enabling per-key restrictions.

Comma-separated restrictions prefixed to a public key, such as from=, command=, and no-port-forwarding, limiting what a key holder may do after authenticating.

Confining a process so its view of the filesystem root is a chosen directory, restricting reachable paths but not isolating kernel resources or privileged escapes.

A kernel isolation feature giving processes private views of resources such as PIDs, mounts, networking, users, and hostnames, the basis of containers.

A kernel facility filtering which system calls a process may make, letting services drop dangerous calls and shrink the impact of a compromise.

Unit-file directives such as ProtectSystem, PrivateTmp, and NoNewPrivileges that constrain a service's filesystem, network, and privilege exposure.