I85PREP
⌘ K
CELE study materials
CELE study resources

CELE: Security basics and system administration tasks

CELE · Work through your exam, one topic at a time.

All guide sections

Security basics and system administration tasks

This domain, Security basics and system administration tasks, tests day-to-day hardening and operations: least privilege, access control beyond mode bits, firewalling, patching, logging, and routine maintenance.

Hardening fundamentals

  • Least privilege: run services as dedicated users, grant specific commands through sudo, and disable direct root SSH login.
  • Mandatory access control: SELinux is checked with getenforce and sestatus, with modes enforcing, permissive, and disabled; contexts appear in ls -Z and are repaired with restorecon or semanage fcontext. AppArmor profiles are summarized by aa-status.
  • Firewalls: firewall-cmd --add-service=https --permanent followed by firewall-cmd --reload, ufw allow 22/tcp, or native nftables rules. Default to denying inbound traffic.
  • Patching: dnf updateinfo list security or apt list --upgradable; reboot after kernel updates unless live patching is in use.

Operations

  • Logs: journalctl -p err -b, /var/log/secure or /var/log/auth.log, last, lastb, and who.
  • Auditing: ausearch -m avc -ts recent for SELinux denials and auditctl for custom rules.
  • Scheduled work: cron through crontab -e and /etc/crontab, systemd timers with OnCalendar=, and logrotate for retention.
  • Capacity checks: df -h, du -sh *, free -h, vmstat, and iostat.

Worked example

After moving a web root to /srv/www, Apache returns 403 and ausearch -m avc -ts recent shows a denial for httpd_t on the new path. Reasoning: the files carry the wrong SELinux type. Run semanage fcontext -a -t httpd_sys_content_t '/srv/www(/.*)?' and then restorecon -Rv /srv/www. Do not switch the system to permissive, which disables protection globally and hides the misconfiguration instead of fixing it.

Traps

  • Using chmod 777 as a permissions fix.
  • Disabling SELinux or AppArmor instead of relabeling files.
  • Adding firewall rules without --permanent or reloading the service.
  • Leaving password authentication enabled on internet-facing SSH.