LPIC-3 Security study plan
LPIC-3 Security · Give each week a clear focus.
8 weeks · About 7 hours per week
Cryptography
Set up an isolated practice VM (no GUI, snapshot before changes) and record its base state so later crypto experiments are repeatable.
Generate and inspect RSA, ECDSA, and Ed25519 keypairs with openssl and ssh-keygen, explaining in your notes which parameters differ and why.
Demonstrate symmetric encryption and authenticated encryption with openssl enc (AES-256-CBC plus HMAC) versus a single AEAD mode, noting the failure mode each protects against.
Explain how a TLS 1.3 handshake establishes confidentiality and authentication, including certificate chain validation and the role of the server name.
Your checkpoint
A one-page crypto cheat sheet plus a shell script that creates, signs, verifies, and encrypts/decrypts a test file, runnable end to end on the practice VM.
Cryptography
Configure a private CA with openssl (root plus intermediate), issue a server certificate with a SAN, and verify the chain with openssl verify.
Configure GnuPG for signing and encryption, create a revocation certificate, and document keyring layout, trust model, and expiry handling.
Compare dm-crypt/LUKS, GPG-encrypted files, and TLS-protected transport by stating the threat each addresses and its operational cost.
Diagnose a deliberately broken certificate (expired, wrong SAN, missing intermediate) and write the exact error text and fix for each.
Your checkpoint
A working private CA directory tree with issued certificates and a written troubleshooting log covering at least three certificate failure cases you reproduced and resolved.
Host Security
Harden a host baseline: disable unnecessary services, set mount options (noexec, nosuid, nodev) on /tmp and /home, and enable a restrictive umask.
Configure and test PAM stacks for password quality, account lockout, and sudo, then explain the order in which modules are evaluated.
Enforce and audit file permissions with find-based checks for world-writable files and unexpected setuid/setgid binaries.
Set up centralized logging and verify that authentication events from your host reach the log collector.
Your checkpoint
A hardening checklist with before/after output proving each control is active, plus a script that reports setuid/setgid and world-writable findings.
Host Security & Access Control
Configure SELinux in enforcing mode, relabel a mislabeled file, and write a small custom policy module for a test service using audit2allow.
Compare SELinux and AppArmor by implementing an equivalent confinement rule in each and stating where they differ operationally.
Deploy a mandatory access control scenario for a web content directory, then verify denials appear in the audit log and are resolved without disabling enforcement.
Explain how capabilities can replace full root privilege for a specific binary and demonstrate the difference with getcap and setcap.
Your checkpoint
A working confined-service setup on the practice VM with an audit log excerpt showing a denial, the policy fix, and confirmation the service runs enforcing.
Access Control
Implement role-based access with sudoers drop-in files, including command restrictions, NOPASSWD scope, and logging, and test allowed and denied paths.
Configure POSIX ACLs and default ACLs on a shared directory and verify inheritance for newly created files.
Set up SSSD or equivalent against a directory service in a lab, or document the join, ID mapping, and access-control filter with configuration excerpts.
Audit authentication and authorization decisions by correlating sudo, PAM, and auditd records for one test user's session.
Your checkpoint
A sudoers and ACL configuration set with a test matrix showing expected versus observed results for at least six allow/deny cases.
Network Security
Write nftables rules implementing a default-deny inbound policy with explicit allowances, then verify with packet counters and a port scan from a second host.
Configure an OpenVPN or WireGuard tunnel between two lab hosts and confirm traffic is encrypted and routed as intended.
Deploy SSH hardening: key-only authentication, restricted ciphers and MACs, and a forced-command or restricted-shell account.
Explain how DNSSEC validation and a filtering resolver differ in what they protect against, and test one of them in the lab.
Your checkpoint
A versioned firewall and VPN configuration set with scan output proving only intended ports are reachable before and after the tunnel is established.
Network Security & Threats and Vulnerability Assessment
Run authenticated and unauthenticated vulnerability scans against the lab VM, triage findings by exploitability, and remediate the top items.
Perform a host integrity assessment using file-integrity monitoring or package verification and interpret the results.
Map a small set of findings to a risk rating method and justify each rating in writing.
Explain how to detect common host compromise indicators through log review and process/network inspection.
Your checkpoint
A short vulnerability report with scan evidence, prioritized findings, remediation actions taken, and a re-scan confirming closure.
Cryptography & Host Security & Access Control & Network Security & Threats and Vulnerability Assessment
Rebuild the lab environment from your own notes and scripts within a time limit to prove the procedures are reproducible.
Complete a timed mixed-domain practice set and classify every error by domain and root cause.
Revisit the two weakest domains identified by that review and close the specific gaps with targeted lab repetition.
Summarize each domain's key commands and decision points on a single reference sheet you would trust under exam pressure.
Your checkpoint
A timed practice-set score log with error analysis and a final one-page per-domain command reference covering all five domains.
Milestones
Week 2: You can build a private CA from scratch and correctly diagnose three distinct certificate validation failures without consulting notes.
Week 4: A confined service runs under enforcing SELinux or AppArmor, and you can explain each denial and its fix from the audit log.
Week 6: A port scan from a second host confirms default-deny inbound policy, and the VPN tunnel carries traffic with verified encryption.
Week 8: You rebuild the full lab from your own documentation within the time limit and score at or above your target on the timed mixed-domain set.