I85PREP
⌘ K
LPIC-3 Security study materials
LPIC-3 Security study resources

LPIC-3 Security: Threats and Vulnerability Assessment

LPIC-3 Security · Work through your exam, one topic at a time.

All guide sections

Threats and Vulnerability Assessment

This domain covers finding exposure before an attacker does and proving that a host has not changed underneath you.

Core rules

  • Inventory: nmap -sS -sV -p- host (SYN scan requires root), -Pn for hosts that drop ping, -sU for UDP (slow), -O for OS hints. Scan only systems you are authorized to test.
  • Vulnerability scanners such as OpenVAS/Greenbone map findings to CVE identifiers and CVSS scores; authenticated scans find substantially more than unauthenticated ones, at the cost of handling credentials.
  • CVSS measures severity, not risk: risk depends on exposure, exploit maturity, and data sensitivity.
  • File integrity: AIDE (aideinit, aide --check), Tripwire, rpm -Va, debsums -c. Baseline after a known-good install and store the database off-host.
  • Rootkit and malware checks: rkhunter --check, chkrootkit, ClamAV - none is conclusive on its own.
  • Logging and patching: auditd, journald, remote syslog, logwatch; dnf-automatic or unattended-upgrades, with verification that updates actually applied and reboots happened.

Worked example

A scanner reports a CVSS 9.8 flaw in a service. ss -tulpn shows it bound to 127.0.0.1 only, and nmap from another host cannot reach it. Reasoning: the finding is genuine but not remotely exploitable, so it ranks below an internet-facing CVSS 6.5 service in the remediation queue - still patch it, but fix the exposed service first.

Traps

Scanning production without a change window; treating every scanner alert as a true positive; running aide --check after legitimate changes without updating the baseline; forgetting that a local-only service may be reachable through a proxy or tunnel; relying on a single rootkit tool for assurance.