LPIC-3 Security study guide
LPIC-3 Security · Work through your exam, one topic at a time.
LPIC-3 Security is one of the specialty certifications in the Linux Professional Institute (LPI) LPIC-3 program, which sits above LPIC-1 and LPIC-2 in LPI's Linux Professional track. The exam itself carries the code 303-300 and is built on objectives version 3.0.0. The LPIC-3 Security study guide has 5 sections and about 1,687 words.
01Cryptography
LPIC-3 Security treats cryptography as an operational skill: you must run OpenSSL and GnuPG confidently, manage X.509 certificates through their whole lifecycle, and judge whether a TLS deployment is actually sound. Symmetric ciphers (AES-GCM, ChaCha20-Poly1305) encrypt bulk data; asymmetric keys (RSA, ECDSA, Ed25519) sign or transport keys.
352 words, about 2 min02Host Security
Host security covers hardening a running Linux system: storage and boot integrity, minimal services, strong authentication, and evidence you can audit later. Reduce attack surface: list listeners with ss -tulpn , then systemctl disable --now , systemctl mask , and remove packages rather than just stopping units.
325 words, about 2 min03Access Control
Access control demands precision: you must understand how DAC, POSIX ACLs, PAM, sudo, and mandatory access control (SELinux, AppArmor) interact, and fix denials at the correct layer. DAC: owner/group/other bits plus umask; setgid on directories inherits the group, the sticky bit on /tmp restricts deletion.
341 words, about 2 min04Network Security
Network security tests packet filtering, stateful firewalling, secure remote access, and your ability to prove what is genuinely listening and reachable. Default-deny: DROP policies on input and forward, accept loopback, accept established/related, then permit explicit services.
324 words, about 2 min05Threats and Vulnerability Assessment
This domain covers finding exposure before an attacker does and proving that a host has not changed underneath you. Inventory: nmap -sS -sV -p- host (SYN scan requires root), -Pn for hosts that drop ping, -sU for UDP (slow), -O for OS hints.
345 words, about 2 min