I85PREP
⌘ K
CELE study materials
CELE study resources

CELE: Networking fundamentals and remote access

CELE · Work through your exam, one topic at a time.

All guide sections

Networking fundamentals and remote access

This domain, Networking fundamentals and remote access, tests addressing and routing basics, name resolution, troubleshooting tools, and secure remote administration over SSH.

Addressing and name resolution

  • IPv4 addresses are 32-bit and CIDR notation gives the prefix length. Private ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16; 127.0.0.0/8 is loopback; 169.254.0.0/16 is link-local and often signals failed DHCP.
  • A host needs an address, a prefix, a default gateway, and DNS servers. Relevant files are /etc/hosts, /etc/resolv.conf, and /etc/nsswitch.conf for lookup order.
  • Modern tools: ip addr, ip route, ip link, ss -tulpn, ping, traceroute, dig, host, and nmcli for NetworkManager. ifconfig and netstat are legacy.

SSH and remote access

  • Server configuration is /etc/ssh/sshd_config, host keys live in /etc/ssh/, and the client reads ~/.ssh/config.
  • Key authentication: ssh-keygen -t ed25519, ssh-copy-id user@host, then the public key in ~/.ssh/authorized_keys on the server.
  • Transfers and tunnels: scp, sftp, rsync -e ssh, and ssh -L 8080:localhost:80 user@host for local port forwarding.
  • Hardening: disable root login and password authentication, restrict AllowUsers, and apply changes with systemctl reload sshd.

Worked example

A server can ping 8.8.8.8 but cannot resolve example.com. Reasoning: routing works, so the fault is name resolution. Check /etc/resolv.conf for a reachable nameserver, then run dig example.com @8.8.8.8 to separate the resolver configuration from DNS itself. If the direct query answers, fix the configured nameserver; if it does not, check firewall egress on UDP and TCP port 53.

Traps

  • A wrong prefix length splitting the subnet so peers appear off-link.
  • Forgetting the default gateway: local pings succeed and remote ones fail.
  • SSH key permissions must be 700 on ~/.ssh and 600 on the private key, or sshd refuses them.
  • Opening a firewall port when the service still listens only on 127.0.0.1.