Difference between revisions of "LPIC-303 Objectives V3.0"

From LPI Wiki
Jump to: navigation, search
(→‎326.2 Host Intrusion Detection (weight: 5))
(→‎332.3 Resource Control (weight: 3))
 
(62 intermediate revisions by 2 users not shown)
Line 1: Line 1:
 
__FORCETOC__
 
__FORCETOC__
 
==Introduction==
 
==Introduction==
−
The description of the entire [[LPIC-3]] programme is listed [[LPIC-3|here]].
+
The description of the entire [[LPIC-3]] program is listed [[LPIC-3|here]].
 
<br />
 
<br />
 
<br />
 
<br />
Line 7: Line 7:
 
==Version Information==
 
==Version Information==
  
−
These objectives are version 2.0.0.
+
These objectives are for version 3.0.0.
  
−
The version [[LPIC-303 Objectives V1|1.x objectives]] can be found [[LPIC-303 Objectives V1|here]].
+
The version [[LPIC-303 Objectives V2|2.0 objectives]] can be found [[LPIC-303 Objectives V2|here]].
  
 
<br />
 
<br />
Line 15: Line 15:
 
==Translations of Objectives==
 
==Translations of Objectives==
 
The following translations of the objectives are available on this wiki:
 
The following translations of the objectives are available on this wiki:
−
* [[LPIC-303|English]]
+
* [[LPIC-303_Objectives_V3.0|English]]
−
* [[LPIC-303(ES)|Spanish]]
+
* [[LPIC-303_Objectives_V3.0(JA)|Japanese]]
 
<br />
 
<br />
  
 
==Objectives==
 
==Objectives==
−
===''Topic 325: Cryptography''===
+
===''Topic 331: Cryptography''===
−
====<span style="color:navy">325.1 X.509 Certificates and Public Key Infrastructures (weight: 5)</span>====
+
====<span style="color:navy">331.1 X.509 Certificates and Public Key Infrastructures (weight: 5)</span>====
 
{|
 
{|
 
| style="background:#dadada" | '''Weight'''
 
| style="background:#dadada" | '''Weight'''
Line 30: Line 30:
 
|}
 
|}
 
'''Key Knowledge Areas:'''
 
'''Key Knowledge Areas:'''
−
* Understand X.509 certificates, X.509 certificate lifecycle, X.509 certificate fields and X.509v3 certificate extensions.
+
* Understand X.509 certificates, X.509 certificate lifecycle, X.509 certificate fields and X.509v3 certificate extensions
−
* Understand trust chains and public key infrastructures.
+
* Understand trust chains and public key infrastructures, including certificate transparency
−
* Generate and manage public and private keys.
+
* Generate and manage public and private keys
−
* Create, operate and secure a certification authority.
+
* Create, operate and secure a certification authority
−
* Request, sign and manage server and client certificates.
+
* Request, sign and manage server and client certificates
−
* Revoke certificates and certification authorities.
+
* Revoke certificates and certification authorities
−
'''The following is a partial list of the used files, terms and utilities:'''
+
* Basic feature knowledge of Let's Encrypt, ACME and certbot
−
* openssl, including relevant subcommands
+
* Basic feature knowledge of CFSSL
 +
'''Partial list of the used files, terms and utilities:'''
 +
* openssl (including relevant subcommands)
 
* OpenSSL configuration
 
* OpenSSL configuration
 
* PEM, DER, PKCS
 
* PEM, DER, PKCS
Line 46: Line 48:
 
<br />
 
<br />
  
−
====<span style="color:navy">325.2 X.509 Certificates for Encryption, Signing and Authentication (weight: 4)</span>====
+
====<span style="color:navy">331.2 X.509 Certificates for Encryption, Signing and Authentication (weight: 4)</span>====
 
{|
 
{|
 
| style="background:#dadada" | '''Weight'''
 
| style="background:#dadada" | '''Weight'''
Line 56: Line 58:
 
'''Key Knowledge Areas:'''
 
'''Key Knowledge Areas:'''
 
* Understand SSL, TLS, including protocol versions and ciphers
 
* Understand SSL, TLS, including protocol versions and ciphers
−
* Understand common transport layer security threats, for example Man-in-the-Middle
 
 
* Configure Apache HTTPD with mod_ssl to provide HTTPS service, including SNI and HSTS
 
* Configure Apache HTTPD with mod_ssl to provide HTTPS service, including SNI and HSTS
−
* Configure Apache HTTPD to serve certificate chains and adjust the cipher configuration (no cipher-specific knowledge)
+
* Configure Apache HTTPD with mod_ssl to serve certificate chains and adjust the cipher configuration (no cipher-specific knowledge)
 
* Configure Apache HTTPD with mod_ssl to authenticate users using certificates
 
* Configure Apache HTTPD with mod_ssl to authenticate users using certificates
 
* Configure Apache HTTPD with mod_ssl to provide OCSP stapling
 
* Configure Apache HTTPD with mod_ssl to provide OCSP stapling
Line 65: Line 66:
 
* httpd.conf
 
* httpd.conf
 
* mod_ssl
 
* mod_ssl
−
* openssl
+
* openssl (including relevant subcommands)
  
 
<br />
 
<br />
  
−
====<span style="color:navy">325.3 Encrypted File Systems (weight: 3)</span>====
+
====<span style="color:navy">331.3 Encrypted File Systems (weight: 3)</span>====
 
{|
 
{|
 
| style="background:#dadada" | '''Weight'''
 
| style="background:#dadada" | '''Weight'''
Line 78: Line 79:
 
|}
 
|}
 
'''Key Knowledge Areas:'''
 
'''Key Knowledge Areas:'''
−
* Understand block device and file system encryption.
+
* Understand block device and file system encryption
−
* Use dm-crypt with LUKS to encrypt block devices.
+
* Use dm-crypt with LUKS1 to encrypt block devices
−
* Use eCryptfs to encrypt file systems, including home directories and PAM integration.
+
* Use eCryptfs to encrypt file systems, including home directories and PAM integration
−
* Be aware of plain dm-crypt and EncFS.
+
* Awareness of plain dm-crypt
 +
* Awareness of LUKS2 features
 +
* Conceptual understanding of Clevis for LUKS devices and Clevis PINs for TMP2 and Network Bound Disk Encryption (NBDE)/Tang
 
'''The following is a partial list of the used files, terms and utilities:'''
 
'''The following is a partial list of the used files, terms and utilities:'''
−
* cryptsetup
+
* cryptsetup (including relevant subcommands)
 
* cryptmount
 
* cryptmount
 
* /etc/crypttab
 
* /etc/crypttab
Line 93: Line 96:
 
<br />
 
<br />
  
−
====<span style="color:navy">325.4 DNS and Cryptography (weight: 5)</span>====
+
====<span style="color:navy">331.4 DNS and Cryptography (weight: 5)</span>====
 
{|
 
{|
 
| style="background:#dadada" | '''Weight'''
 
| style="background:#dadada" | '''Weight'''
Line 102: Line 105:
 
|}
 
|}
 
'''Key Knowledge Areas:'''
 
'''Key Knowledge Areas:'''
−
* Understand the concept of DNS, Zones and resource records
+
* Understand the concepts of DNS, zones and resource records
−
* Understand DNSSEC, including Key Signing Keys, Zone Signing Keys and relevant DNS records such as DS, DNSKEY, RRSIG, NSEC, NSEC3 and NSEC3PARAM
+
* Understand DNSSEC, including key signing keys, zone signing keys and relevant DNS records such as DS, DNSKEY, RRSIG, NSEC, NSEC3  
−
* Understand CAA and DANE, including relevant DNS records such as CAA and TLSA
+
and NSEC3PARAM
 
* Configure and troubleshoot BIND as an authoritative name server serving DNSSEC secured zones
 
* Configure and troubleshoot BIND as an authoritative name server serving DNSSEC secured zones
−
* Configure BIND as an recursive name server that performs DNSSEC validation on behalf of its clients
 
 
* Manage DNSSEC signed zones, including key generation, key rollover and re-signing of zones
 
* Manage DNSSEC signed zones, including key generation, key rollover and re-signing of zones
 +
* Configure BIND as an recursive name server that performs DNSSEC validation on behalf of its clients
 +
* Understand CAA and DANE, including relevant DNS records such as CAA and TLSA
 
* Use CAA and DANE to publish X.509 certificate and certificate authority information in DNS
 
* Use CAA and DANE to publish X.509 certificate and certificate authority information in DNS
 
* Use TSIG for secure communication with BIND
 
* Use TSIG for secure communication with BIND
Line 118: Line 122:
 
* dnssec-settime
 
* dnssec-settime
 
* dnssec-dsfromkey
 
* dnssec-dsfromkey
−
* rndc
+
* rndc (including relevant subcommands)
 
* dig
 
* dig
 
* delv
 
* delv
−
* openssl
+
* openssl (including relevant subcommands)
  
 
<br />
 
<br />
 
<br />
 
<br />
  
−
===''Topic 326: Host Security''===
+
===''Topic 332: Host Security''===
  
−
====<span style="color:navy">326.1 Host Hardening (weight: 4)</span>====
+
====<span style="color:navy">332.1 Host Hardening (weight: 5)</span>====
 
{|
 
{|
 
| style="background:#dadada" | '''Weight'''
 
| style="background:#dadada" | '''Weight'''
−
| style="background:#eaeaea" | 4
+
| style="background:#eaeaea" | 5
 
|-
 
|-
 
| style="background:#dadada; padding-right:1em" | '''Description'''
 
| style="background:#dadada; padding-right:1em" | '''Description'''
−
| style="background:#eaeaea" | Candidates should be able to secure computers running Linux against common threats. This includes kernel and software configuration.
+
| style="background:#eaeaea" | Candidates should be able to secure computers running Linux against common threats.
 
|}
 
|}
 
'''Key Knowledge Areas:'''
 
'''Key Knowledge Areas:'''
−
* Configure BIOS and boot loader (GRUB 2) security.
+
* Configure BIOS and boot loader (GRUB 2) security
−
* Disable useless software and services.
+
* Disable unused software and services
−
* Use sysctl for security related kernel configuration, particularly ASLR, Exec-Shield and IP / ICMP configuration.
+
* Understand and drop unnecessary capabilities for specific systemd units and the entire system
−
* Work with chroot environments.
+
* Understand and configure Address Space Layout Randomization (ASLR), Data Execution Prevention (DEP) and Exec-Shield
−
* Drop unnecessary capabilities.
+
* Black and white list USB devices attached to a computer using USBGuard
−
* Be aware of the security advantages of virtualization.
+
* Create an SSH CA, create SSH certificates for host and user keys using the CA and configure OpenSSH to use SSH certificates
 +
* Work with chroot environments
 +
* Use systemd units to limit the system calls and capabilities available to a process
 +
* Use systemd units to start processes with limited or no access to specific files and devices
 +
* Use systemd units to start processes with dedicated temporary and /dev directories and without network access
 +
* Understand the implications of Linux Meltdown and Spectre mitigations and enable/disable the mitigations
 +
* Awareness of polkit
 +
* Awareness of the security advantages of virtualization and containerization
 
'''The following is a partial list of the used files, terms and utilities:'''
 
'''The following is a partial list of the used files, terms and utilities:'''
 
* grub.cfg
 
* grub.cfg
−
* chkconfig, systemctl
+
* systemctl
−
* chroot
+
* getcap
 +
* setcap
 +
* capsh
 
* sysctl
 
* sysctl
 
* /etc/sysctl.conf
 
* /etc/sysctl.conf
 +
* /etc/usbguard/usbguard-daemon.conf
 +
* /etc/usbguard/rules.conf
 +
* usbguard
 +
* ssh-keygen
 +
* /etc/ssh/
 +
* ~/.ssh/
 +
* /etc/ssh/sshd_config
 +
* chroot
 
<br />
 
<br />
  
−
====<span style="color:navy">326.2 Host Intrusion Detection (weight: 5)</span>====
+
====<span style="color:navy">332.2 Host Intrusion Detection (weight: 5)</span>====
 
{|
 
{|
 
| style="background:#dadada" | '''Weight'''
 
| style="background:#dadada" | '''Weight'''
Line 157: Line 178:
 
|-
 
|-
 
| style="background:#dadada; padding-right:1em" | '''Description'''
 
| style="background:#dadada; padding-right:1em" | '''Description'''
−
| style="background:#eaeaea" | Candidates should be familiar with the use and configuration of common host intrusion detection software. This includes updates and maintenance as well as automated host scans.
+
| style="background:#eaeaea" | Candidates should be familiar with the use and configuration of common host intrusion detection software. This includes managing the Linux Audit system and verifying a system's integrity.
 
|}
 
|}
 
'''Key Knowledge Areas:'''
 
'''Key Knowledge Areas:'''
Line 187: Line 208:
 
<br />
 
<br />
  
−
====<span style="color:navy">326.3 Removed</span>====
+
====<span style="color:navy">332.3 Resource Control (weight: 3)</span>====
−
<br />
+
−
 
+
−
====<span style="color:navy">326.4 Removed</span>====
+
−
<br />
+
−
 
+
−
====<span style="color:navy">326.5 Resource Control (weight: 3)</span>====
+
 
{|
 
{|
 
| style="background:#dadada" | '''Weight'''
 
| style="background:#dadada" | '''Weight'''
Line 203: Line 218:
 
'''Key Knowledge Areas:'''
 
'''Key Knowledge Areas:'''
 
* Understand and configure ulimits
 
* Understand and configure ulimits
−
* Understand cgroups, including classes, limits, accounting and tasks
+
* Understand cgroups, including classes, limits and accounting
 
* Manage cgroups and process cgroup association
 
* Manage cgroups and process cgroup association
−
* Configure resource limits in systemd units
+
* Understand systemd slices, scopes and services
 +
* Use systemd units to limit the system resources processes can consume
 
* Awareness of cgmanager and libcgroup utilities
 
* Awareness of cgmanager and libcgroup utilities
 
'''Partial list of the used files, terms and utilities:'''
 
'''Partial list of the used files, terms and utilities:'''
Line 211: Line 227:
 
* /etc/security/limits.conf
 
* /etc/security/limits.conf
 
* pam_limits.so
 
* pam_limits.so
−
* /sys/fs/group/
+
* /sys/fs/cgroup/
 
* /proc/cgroups
 
* /proc/cgroups
 
* systemd-cgls
 
* systemd-cgls
Line 218: Line 234:
 
<br />
 
<br />
  
−
===''Topic 327: Access Control''===
+
===''Topic 333: Access Control''===
−
====<span style="color:navy">327.1 Discretionary Access Control (weight: 3)</span>====
+
====<span style="color:navy">333.1 Discretionary Access Control (weight: 3)</span>====
 
{|
 
{|
 
| style="background:#dadada" | '''Weight'''
 
| style="background:#dadada" | '''Weight'''
Line 225: Line 241:
 
|-
 
|-
 
| style="background:#dadada; padding-right:1em" | '''Description'''
 
| style="background:#dadada; padding-right:1em" | '''Description'''
−
| style="background:#eaeaea" | Candidates should understand Discretionary Access Control and know how to implement it using Access Control Lists. Additionally, candidates are required to understand and know how to use Extended Attributes.
+
| style="background:#eaeaea" | Candidates should understand discretionary access control (DAC) and know how to implement it using access control lists (ACL). Additionally, candidates are required to understand and know how to use extended attributes.
 
|}
 
|}
 
'''Key Knowledge Areas:'''
 
'''Key Knowledge Areas:'''
−
* Understand and manage file ownership and permissions, including SUID and SGID
+
* Understand and manage file ownership and permissions, including SetUID and SetGID bits
 
* Understand and manage access control lists
 
* Understand and manage access control lists
 
* Understand and manage extended attributes and attribute classes
 
* Understand and manage extended attributes and attribute classes
Line 239: Line 255:
 
<br />
 
<br />
  
−
====<span style="color:navy">327.2 Mandatory Access Control (weight: 5)</span>====
+
====<span style="color:navy">333.2 Mandatory Access Control (weight: 5)</span>====
 
{|
 
{|
 
| style="background:#dadada" | '''Weight'''
 
| style="background:#dadada" | '''Weight'''
Line 245: Line 261:
 
|-
 
|-
 
| style="background:#dadada; padding-right:1em" | '''Description'''
 
| style="background:#dadada; padding-right:1em" | '''Description'''
−
| style="background:#eaeaea" | Candidates should be familiar with Mandatory Access Control systems for Linux. Specifically, candidates should have a thorough knowledge of SELinux. Also, candidates should be aware of other Mandatory Access Control systems for Linux. This includes major features of these systems but not configuration and use.
+
| style="background:#eaeaea" | Candidates should be familiar with mandatory access control (MAC) systems for Linux. Specifically, candidates should have a thorough knowledge of SELinux. Also, candidates should be aware of other mandatory access control systems for Linux. This includes major features of these systems but not configuration and use.
 
|}
 
|}
 
'''Key Knowledge Areas:'''
 
'''Key Knowledge Areas:'''
−
* Understand the concepts of Type Enforcement, Role Based Access Control, Mandatory Access Control and Discretionary Access Control
+
* Understand the concepts of type enforcement, role based access control, mandatory access control and discretionary access control
 
* Configure, manage and use SELinux
 
* Configure, manage and use SELinux
 
* Awareness of AppArmor and Smack
 
* Awareness of AppArmor and Smack
Line 262: Line 278:
 
* setfiles
 
* setfiles
 
* newrole
 
* newrole
 +
* setcon
 
* runcon
 
* runcon
 +
* chcon
 
* semanage
 
* semanage
 
* sestatus
 
* sestatus
Line 268: Line 286:
 
* apol
 
* apol
 
* seaudit
 
* seaudit
−
* seaudit-report
 
 
* audit2why
 
* audit2why
 
* audit2allow
 
* audit2allow
Line 277: Line 294:
 
<br />
 
<br />
  
−
===''Topic 328: Network Security''===
+
===''Topic 334: Network Security''===
−
====<span style="color:navy">328.1 Network Hardening (weight: 4)</span>====
+
====<span style="color:navy">334.1 Network Hardening (weight: 4)</span>====
 
{|
 
{|
 
| style="background:#dadada" | '''Weight'''
 
| style="background:#dadada" | '''Weight'''
Line 284: Line 301:
 
|-
 
|-
 
| style="background:#dadada; padding-right:1em" | '''Description'''
 
| style="background:#dadada; padding-right:1em" | '''Description'''
−
| style="background:#eaeaea" | Candidates should be able to secure networks against common threats. This includes verification of the effectiveness of security measures.
+
| style="background:#eaeaea" | Candidates should be able to secure networks against common threats. This includes analyzing network traffic of specific nodes and protocols.
 
|}
 
|}
 
'''Key Knowledge Areas:'''
 
'''Key Knowledge Areas:'''
−
* Configure FreeRADIUS to authenticate network nodes.
+
* Understand wireless networks security mechanisms
−
* Use nmap to scan networks and hosts, including different scan methods.
+
* Configure FreeRADIUS to authenticate network nodes
−
* Use Wireshark to analyze network traffic, including filters and statistics.
+
* Use Wireshark and tcpdump to analyze network traffic, including filters and statistics
−
* Identify and deal with rogue router advertisements and DHCP messages.
+
* Use Kismet to analyze wireless networks and capture wireless network traffic
 +
* Identify and deal with rogue router advertisements and DHCP messages
 +
* Awareness of aircrack-ng and bettercap
 
'''The following is a partial list of the used files, terms and utilities:'''
 
'''The following is a partial list of the used files, terms and utilities:'''
 
* radiusd
 
* radiusd
 
* radmin
 
* radmin
−
* radtest, radclient
+
* radtest
−
* radlast, radwho
+
* radclient
 +
* radlast
 +
* radwho
 
* radiusd.conf
 
* radiusd.conf
 
* /etc/raddb/*
 
* /etc/raddb/*
−
* nmap
 
 
* wireshark
 
* wireshark
 
* tshark
 
* tshark
 
* tcpdump
 
* tcpdump
 +
* kismet
 
* ndpmon
 
* ndpmon
  
 
<br />
 
<br />
  
−
====<span style="color:navy">328.2 Network Intrusion Detection (weight: 4)</span>====
+
====<span style="color:navy">334.2 Network Intrusion Detection (weight: 4)</span>====
 
{|
 
{|
 
| style="background:#dadada" | '''Weight'''
 
| style="background:#dadada" | '''Weight'''
Line 315: Line 336:
 
|}
 
|}
 
'''Key Knowledge Areas:'''
 
'''Key Knowledge Areas:'''
−
* Implement bandwidth usage monitoring.
+
* Implement bandwidth usage monitoring
−
* Configure and use Snort, including rule management.
+
* Configure and use Snort, including rule management
−
* Configure and use OpenVAS, including NASL.
+
* Configure and use OpenVAS, including NASL
−
'''The following is a partial list of the used files, terms and utilities:'''
+
'''Partial list of the used files, terms and utilities:'''
 
* ntop
 
* ntop
−
* Cacti
 
 
* snort
 
* snort
 
* snort-stat
 
* snort-stat
 +
* pulledpork.pl
 
* /etc/snort/*
 
* /etc/snort/*
−
* openvas-adduser, openvas-rmuser
+
* openvas-adduser
 +
* openvas-rmuser
 
* openvas-nvt-sync
 
* openvas-nvt-sync
 
* openvassd
 
* openvassd
 
* openvas-mkcert
 
* openvas-mkcert
 +
* openvas-feed-update
 
* /etc/openvas/*
 
* /etc/openvas/*
  
 
<br />
 
<br />
  
−
====<span style="color:navy">328.3 Packet Filtering (weight: 5)</span>====
+
====<span style="color:navy">334.3 Packet Filtering (weight: 5)</span>====
 
{|
 
{|
 
| style="background:#dadada" | '''Weight'''
 
| style="background:#dadada" | '''Weight'''
Line 338: Line 361:
 
|-
 
|-
 
| style="background:#dadada; padding-right:1em" | '''Description'''
 
| style="background:#dadada; padding-right:1em" | '''Description'''
−
| style="background:#eaeaea" | Candidates should be familiar with the use and configuration of the netfilter Linux packet filter using iptables and ip6tables.
+
| style="background:#eaeaea" | Candidates should be familiar with the use and configuration of the netfilter Linux packet filter.
 
|}
 
|}
 
'''Key Knowledge Areas:'''
 
'''Key Knowledge Areas:'''
Line 352: Line 375:
 
* iptables
 
* iptables
 
* ip6tables
 
* ip6tables
−
* iptables-save, iptables-restore  
+
* iptables-save
−
* ip6tables-save, ip6tables-restore  
+
* iptables-restore  
 +
* ip6tables-save
 +
* ip6tables-restore  
 
* ipset
 
* ipset
−
* nft
 
−
* ebtables
 
 
<br />
 
<br />
  
−
====<span style="color:navy">328.4 Virtual Private Networks (weight: 4)</span>====
+
====<span style="color:navy">334.4 Virtual Private Networks (weight: 4)</span>====
 
{|
 
{|
 
| style="background:#dadada" | '''Weight'''
 
| style="background:#dadada" | '''Weight'''
Line 365: Line 388:
 
|-
 
|-
 
| style="background:#dadada; padding-right:1em" | '''Description'''
 
| style="background:#dadada; padding-right:1em" | '''Description'''
−
| style="background:#eaeaea" | Candidates should be familiar with the use of OpenVPN, IPsec and WireGuard to set up remote access and site to site VPN.
+
| style="background:#eaeaea" | Candidates should be familiar with the use of OpenVPN, IPsec and WireGuard to set up remote access and site to site VPNs.
 
|}
 
|}
 
'''Key Knowledge Areas:'''
 
'''Key Knowledge Areas:'''
−
* Understand the principles of bridged and routed VPN
+
* Understand the principles of bridged and routed VPNs
 
* Understand the principles and major differences of the OpenVPN, IPsec, IKEv2 and WireGuard protocols
 
* Understand the principles and major differences of the OpenVPN, IPsec, IKEv2 and WireGuard protocols
 
* Configure and operate OpenVPN servers and clients
 
* Configure and operate OpenVPN servers and clients
Line 384: Line 407:
 
* /etc/wireguard/
 
* /etc/wireguard/
 
* wg
 
* wg
 +
* wg-quick
 
* ip
 
* ip
  
 
<br />
 
<br />
  
−
===''Topic 329: Threats and Vulnerability Assessment''===
+
===''Topic 335: Threats and Vulnerability Assessment''===
  
−
====<span style="color:navy">329.1 Common Vulnerabilities and Attacks (weight: 2)</span>====
+
====<span style="color:navy">335.1 Common Security Vulnerabilities and Threats (weight: 2)</span>====
 
{|
 
{|
 
| style="background:#dadada" | '''Weight'''
 
| style="background:#dadada" | '''Weight'''
Line 396: Line 420:
 
|-
 
|-
 
| style="background:#dadada; padding-right:1em" | '''Description'''
 
| style="background:#dadada; padding-right:1em" | '''Description'''
−
| style="background:#eaeaea" | Candidates should understand the principle of major types of security vulnerabilities and attacks.
+
| style="background:#eaeaea" | Candidates should understand the principle of major types of security vulnerabilities and threats.
 
|}
 
|}
 
'''Key Knowledge Areas:'''
 
'''Key Knowledge Areas:'''
−
*  
+
* Conceptual understanding of threats against individual nodes
 +
* Conceptual understanding of threats against networks
 +
* Conceptual understanding of threats against application
 +
* Conceptual understanding of threats against credentials and confidentiality
 +
* Conceptual understanding of honeypots
 
'''The following is a partial list of the used files, terms and utilities:'''
 
'''The following is a partial list of the used files, terms and utilities:'''
−
*  
+
* Trojans
−
 
+
* Viruses
 +
* Rootkits
 +
* Keylogger
 +
* DoS and DDoS
 +
* Man in the Middle
 +
* ARP and NDP forgery
 +
* Rogue Access Points, Routers and DHCP servers
 +
* Link layer address and IP address spoofing
 +
* Buffer Overflows
 +
* SQL and Code Injections
 +
* Cross Site Scripting
 +
* Cross Site Request Forgery
 +
* Privilege escalation
 +
* Brute Force Attacks
 +
* Rainbow tables
 +
* Phishing
 +
* Social Engineering
 
<br />
 
<br />
  
−
====<span style="color:navy">329.2 Penetration Testing (weight: 4)</span>====
+
====<span style="color:navy">335.2 Penetration Testing (weight: 3)</span>====
 
{|
 
{|
 
| style="background:#dadada" | '''Weight'''
 
| style="background:#dadada" | '''Weight'''
−
| style="background:#eaeaea" | 4
+
| style="background:#eaeaea" | 3
 
|-
 
|-
 
| style="background:#dadada; padding-right:1em" | '''Description'''
 
| style="background:#dadada; padding-right:1em" | '''Description'''
−
| style="background:#eaeaea" | Candidates should be able to confirm the effectiveness of security measures by conducting penetration tests against their own systems.
+
| style="background:#eaeaea" | Candidates understand the concepts of penetration testing, including an understand of commonly used penetration testing tools. Furthermore, candidates should be able to use nmap to verify the effectiveness of network security measures.
 
|}
 
|}
 
'''Key Knowledge Areas:'''
 
'''Key Knowledge Areas:'''
−
*  
+
* Understand the concepts of penetration testing and ethical hacking
−
'''The following is a partial list of the used files, terms and utilities:'''
+
* Understand legal implications of penetration testing
−
*  
+
* Understand the phases of penetration tests, such as active and passive information gathering, enumeration, gaining access, privilege escalation, access maintenance, covering tracks
 +
* Understand the architecture and components of Metasploit, including Metasploit module types and how Metasploit integrates various security tools
 +
* Use nmap to scan networks and hosts, including different scan methods, version scans and operating system recognition
 +
* Understand the concepts of Nmap Scripting Engine and execute existing scripts
 +
* Awareness of Kali Linux, Armitage and the Social Engineer Toolkit (SET)
 +
'''Partial list of the used files, terms and utilities:'''
 +
* nmap
  
 
<br />
 
<br />
 +
==Future Change Considerations==
  
−
==Other Comments for consideration==
+
* Future changes to the objective will/may include:
−
 
+
* Advanced sudo configuration is absent
−
As examples, following items are not in the current objectives:
+
* Awareness/knowledge of the LSM framework would be nice to add (SElinux and Apparmor/Smack are mentioned but there are more than that)
−
 
+
* Advanced configuration/usage of filesystems (btrfs, ext4, xfs, nfs, etc) deserve a place in LPIC-303
−
1) <del><b>Related to Wireless LAN:</b> (Note: It’s not only for Linux though, it is necessary to consider because there are many points to be taken care for configuration in terms of security measure.)</del>
+
* Namespaces are absent
−
 
+
* nmap should get moved to Topic 334: Network Security
−
Some aspects (i.e. Radius) are implemented in V2 (fth)
+
* The whole 335.2 Penetration Testing is a bit out of place in my opinion. I would prefer a section about compliance with GDPR, NIST, HIPAA, etc, instead (at awareness level)
−
 
+
* There is no mention of the kernel and kernel modules (blacklisting, module parameter configuration, etc)
−
2) <del><b>Related to IPv6:</b> Not only IPv4, but also IPv6 should be considered.</del>
+
−
 
+
−
Implemented in V2 wherever applicable (fth)
+
−
 
+
−
3) <del><b>Security features in Linux:</b> For example, ASLR and Exec-Shield (ASCII Armor) should be considered, because it causes security level lower if those are disabled.</del>
+
−
 
+
−
Implemented in host hardening in V2 (fth)
+
−
 
+
−
4) <del><b>Related to Forensics:</b> In the survey of malware’s behavior, Sleuth Kit would be used to analyze the hard disk on Linux machine. Also in some cases, LVM commands would be used to restore the disk which became un-mountable. So that this area should be learned.</del>
+
−
 
+
−
This is an interesting topic, but it goes beyond basic security in the sense it "prevention and defending". This is postmortal analysis. As the exam already contains a lot of topic this is postponed but up to discussion (fth)
+
−
 
+
−
5) <del><b>Database (RDB, NoSQL) security:</b> Because Application Security (bind, apache, etc.) is covered now, this item would be nice to cover. And this item is listed in the CIF, security contest almost every time. Also the counter-measure in server side is necessary.</del>
+
−
 
+
−
As the other software / service aspects beyond Linux system security have been dropped this is considered out of scope for now too (fth)
+
−
 
+
−
6) <del><b>Related to OpenFlow:</b> There are several points to be considered in terms of security measure about the configuration of OpenFlow.</del>
+
−
 
+
−
This is considered as an application aspect which seems to be beyond the scope for not (fth).
+
−
 
+
−
7) <del><b>RADIUS:</b> This was covered in 301 though, this is not covered now. This should be covered.</del>
+
−
 
+
−
Implemented in V2 (fth)
+
−
 
+
−
8) <del><b>DNS:</b> More DNSSEC and DANE.</del>
+
−
 
+
−
Implemented in V2 (fth)
+
−
 
+
−
9) <del><b>Secure development, hardening</b></del>
+
−
 
+
−
Hardening has been implemented for both hosts and networks in V2 (fth), Secure development is considered out of scope for now (fth)
+
−
 
+
−
10) Certificate Transparency
+
−
 
+
−
11) polkit
+

Latest revision as of 03:36, 22 March 2024

Introduction

The description of the entire LPIC-3 program is listed here.

Version Information

These objectives are for version 3.0.0.

The version 2.0 objectives can be found here.


Translations of Objectives

The following translations of the objectives are available on this wiki:


Objectives

Topic 331: Cryptography

331.1 X.509 Certificates and Public Key Infrastructures (weight: 5)

Weight 5
Description Candidates should understand X.509 certificates and public key infrastructures. They should know how to configure and use OpenSSL to implement certification authorities and issue SSL certificates for various purposes.

Key Knowledge Areas:

  • Understand X.509 certificates, X.509 certificate lifecycle, X.509 certificate fields and X.509v3 certificate extensions
  • Understand trust chains and public key infrastructures, including certificate transparency
  • Generate and manage public and private keys
  • Create, operate and secure a certification authority
  • Request, sign and manage server and client certificates
  • Revoke certificates and certification authorities
  • Basic feature knowledge of Let's Encrypt, ACME and certbot
  • Basic feature knowledge of CFSSL

Partial list of the used files, terms and utilities:

  • openssl (including relevant subcommands)
  • OpenSSL configuration
  • PEM, DER, PKCS
  • CSR
  • CRL
  • OCSP


331.2 X.509 Certificates for Encryption, Signing and Authentication (weight: 4)

Weight 4
Description Candidates should be able to use X.509 certificates for both server and client authentication. This includes implementing user and server authentication for Apache HTTPD. The version of Apache HTTPD covered is 2.4 or higher.

Key Knowledge Areas:

  • Understand SSL, TLS, including protocol versions and ciphers
  • Configure Apache HTTPD with mod_ssl to provide HTTPS service, including SNI and HSTS
  • Configure Apache HTTPD with mod_ssl to serve certificate chains and adjust the cipher configuration (no cipher-specific knowledge)
  • Configure Apache HTTPD with mod_ssl to authenticate users using certificates
  • Configure Apache HTTPD with mod_ssl to provide OCSP stapling
  • Use OpenSSL for SSL/TLS client and server tests

Partial list of the used files, terms and utilities:

  • httpd.conf
  • mod_ssl
  • openssl (including relevant subcommands)


331.3 Encrypted File Systems (weight: 3)

Weight 3
Description Candidates should be able to set up and configure encrypted file systems.

Key Knowledge Areas:

  • Understand block device and file system encryption
  • Use dm-crypt with LUKS1 to encrypt block devices
  • Use eCryptfs to encrypt file systems, including home directories and PAM integration
  • Awareness of plain dm-crypt
  • Awareness of LUKS2 features
  • Conceptual understanding of Clevis for LUKS devices and Clevis PINs for TMP2 and Network Bound Disk Encryption (NBDE)/Tang

The following is a partial list of the used files, terms and utilities:

  • cryptsetup (including relevant subcommands)
  • cryptmount
  • /etc/crypttab
  • ecryptfsd
  • ecryptfs-* commands
  • mount.ecryptfs, umount.ecryptfs
  • pam_ecryptfs


331.4 DNS and Cryptography (weight: 5)

Weight 5
Description Candidates should have experience and knowledge of cryptography in the context of DNS and its implementation using BIND. The version of BIND covered is 9.7 or higher.

Key Knowledge Areas:

  • Understand the concepts of DNS, zones and resource records
  • Understand DNSSEC, including key signing keys, zone signing keys and relevant DNS records such as DS, DNSKEY, RRSIG, NSEC, NSEC3

and NSEC3PARAM

  • Configure and troubleshoot BIND as an authoritative name server serving DNSSEC secured zones
  • Manage DNSSEC signed zones, including key generation, key rollover and re-signing of zones
  • Configure BIND as an recursive name server that performs DNSSEC validation on behalf of its clients
  • Understand CAA and DANE, including relevant DNS records such as CAA and TLSA
  • Use CAA and DANE to publish X.509 certificate and certificate authority information in DNS
  • Use TSIG for secure communication with BIND
  • Awareness of DNS over TLS and DNS over HTTPS
  • Awareness of Multicast DNS

Partial list of the used files, terms and utilities:

  • named.conf
  • dnssec-keygen
  • dnssec-signzone
  • dnssec-settime
  • dnssec-dsfromkey
  • rndc (including relevant subcommands)
  • dig
  • delv
  • openssl (including relevant subcommands)



Topic 332: Host Security

332.1 Host Hardening (weight: 5)

Weight 5
Description Candidates should be able to secure computers running Linux against common threats.

Key Knowledge Areas:

  • Configure BIOS and boot loader (GRUB 2) security
  • Disable unused software and services
  • Understand and drop unnecessary capabilities for specific systemd units and the entire system
  • Understand and configure Address Space Layout Randomization (ASLR), Data Execution Prevention (DEP) and Exec-Shield
  • Black and white list USB devices attached to a computer using USBGuard
  • Create an SSH CA, create SSH certificates for host and user keys using the CA and configure OpenSSH to use SSH certificates
  • Work with chroot environments
  • Use systemd units to limit the system calls and capabilities available to a process
  • Use systemd units to start processes with limited or no access to specific files and devices
  • Use systemd units to start processes with dedicated temporary and /dev directories and without network access
  • Understand the implications of Linux Meltdown and Spectre mitigations and enable/disable the mitigations
  • Awareness of polkit
  • Awareness of the security advantages of virtualization and containerization

The following is a partial list of the used files, terms and utilities:

  • grub.cfg
  • systemctl
  • getcap
  • setcap
  • capsh
  • sysctl
  • /etc/sysctl.conf
  • /etc/usbguard/usbguard-daemon.conf
  • /etc/usbguard/rules.conf
  • usbguard
  • ssh-keygen
  • /etc/ssh/
  • ~/.ssh/
  • /etc/ssh/sshd_config
  • chroot


332.2 Host Intrusion Detection (weight: 5)

Weight 5
Description Candidates should be familiar with the use and configuration of common host intrusion detection software. This includes managing the Linux Audit system and verifying a system's integrity.

Key Knowledge Areas:

  • Use and configure the Linux Audit system
  • Use chkrootkit
  • Use and configure rkhunter, including updates
  • Use Linux Malware Detect
  • Automate host scans using cron
  • Use RPM and DPKG package management tools to verify the integrity of installed files
  • Configure and use AIDE, including rule management
  • Awareness of OpenSCAP

Partial list of the used files, terms and utilities:

  • auditd
  • auditctl
  • ausearch, aureport
  • auditd.conf
  • audit.rules
  • pam_tty_audit.so
  • chkrootkit
  • rkhunter
  • /etc/rkhunter.conf
  • maldet
  • conf.maldet
  • rpm
  • dpkg
  • aide
  • /etc/aide/aide.conf


332.3 Resource Control (weight: 3)

Weight 3
Description Candidates should be able to restrict the resources services and programs can consume.

Key Knowledge Areas:

  • Understand and configure ulimits
  • Understand cgroups, including classes, limits and accounting
  • Manage cgroups and process cgroup association
  • Understand systemd slices, scopes and services
  • Use systemd units to limit the system resources processes can consume
  • Awareness of cgmanager and libcgroup utilities

Partial list of the used files, terms and utilities:

  • ulimit
  • /etc/security/limits.conf
  • pam_limits.so
  • /sys/fs/cgroup/
  • /proc/cgroups
  • systemd-cgls
  • systemd-cgtop



Topic 333: Access Control

333.1 Discretionary Access Control (weight: 3)

Weight 3
Description Candidates should understand discretionary access control (DAC) and know how to implement it using access control lists (ACL). Additionally, candidates are required to understand and know how to use extended attributes.

Key Knowledge Areas:

  • Understand and manage file ownership and permissions, including SetUID and SetGID bits
  • Understand and manage access control lists
  • Understand and manage extended attributes and attribute classes

Partial list of the used files, terms and utilities:

  • getfacl
  • setfacl
  • getfattr
  • setfattr


333.2 Mandatory Access Control (weight: 5)

Weight 5
Description Candidates should be familiar with mandatory access control (MAC) systems for Linux. Specifically, candidates should have a thorough knowledge of SELinux. Also, candidates should be aware of other mandatory access control systems for Linux. This includes major features of these systems but not configuration and use.

Key Knowledge Areas:

  • Understand the concepts of type enforcement, role based access control, mandatory access control and discretionary access control
  • Configure, manage and use SELinux
  • Awareness of AppArmor and Smack

Partial list of the used files, terms and utilities:

  • getenforce
  • setenforce
  • selinuxenabled
  • getsebool
  • setsebool
  • togglesebool
  • fixfiles
  • restorecon
  • setfiles
  • newrole
  • setcon
  • runcon
  • chcon
  • semanage
  • sestatus
  • seinfo
  • apol
  • seaudit
  • audit2why
  • audit2allow
  • /etc/selinux/*



Topic 334: Network Security

334.1 Network Hardening (weight: 4)

Weight 4
Description Candidates should be able to secure networks against common threats. This includes analyzing network traffic of specific nodes and protocols.

Key Knowledge Areas:

  • Understand wireless networks security mechanisms
  • Configure FreeRADIUS to authenticate network nodes
  • Use Wireshark and tcpdump to analyze network traffic, including filters and statistics
  • Use Kismet to analyze wireless networks and capture wireless network traffic
  • Identify and deal with rogue router advertisements and DHCP messages
  • Awareness of aircrack-ng and bettercap

The following is a partial list of the used files, terms and utilities:

  • radiusd
  • radmin
  • radtest
  • radclient
  • radlast
  • radwho
  • radiusd.conf
  • /etc/raddb/*
  • wireshark
  • tshark
  • tcpdump
  • kismet
  • ndpmon


334.2 Network Intrusion Detection (weight: 4)

Weight 4
Description Candidates should be familiar with the use and configuration of network security scanning, network monitoring and network intrusion detection software. This includes updating and maintaining the security scanners.

Key Knowledge Areas:

  • Implement bandwidth usage monitoring
  • Configure and use Snort, including rule management
  • Configure and use OpenVAS, including NASL

Partial list of the used files, terms and utilities:

  • ntop
  • snort
  • snort-stat
  • pulledpork.pl
  • /etc/snort/*
  • openvas-adduser
  • openvas-rmuser
  • openvas-nvt-sync
  • openvassd
  • openvas-mkcert
  • openvas-feed-update
  • /etc/openvas/*


334.3 Packet Filtering (weight: 5)

Weight 5
Description Candidates should be familiar with the use and configuration of the netfilter Linux packet filter.

Key Knowledge Areas:

  • Understand common firewall architectures, including DMZ
  • Understand and use iptables and ip6tables, including standard modules, tests and targets
  • Implement packet filtering for IPv4 and IPv6
  • Implement connection tracking and network address translation
  • Manage IP sets and use them in netfilter rules
  • Awareness of nftables and nft
  • Awareness of ebtables
  • Awareness of conntrackd

Partial list of the used files, terms and utilities:

  • iptables
  • ip6tables
  • iptables-save
  • iptables-restore
  • ip6tables-save
  • ip6tables-restore
  • ipset


334.4 Virtual Private Networks (weight: 4)

Weight 4
Description Candidates should be familiar with the use of OpenVPN, IPsec and WireGuard to set up remote access and site to site VPNs.

Key Knowledge Areas:

  • Understand the principles of bridged and routed VPNs
  • Understand the principles and major differences of the OpenVPN, IPsec, IKEv2 and WireGuard protocols
  • Configure and operate OpenVPN servers and clients
  • Configure and operate IPsec servers and clients using strongSwan
  • Configure and operate WireGuard servers and clients
  • Awareness of L2TP

Partial list of the used files, terms and utilities:

  • /etc/openvpn/
  • openvpn
  • /etc/strongswan.conf
  • /etc/strongswan.d/
  • /etc/swanctl/swanctl.conf
  • /etc/swanctl/
  • swanctl
  • /etc/wireguard/
  • wg
  • wg-quick
  • ip


Topic 335: Threats and Vulnerability Assessment

335.1 Common Security Vulnerabilities and Threats (weight: 2)

Weight 2
Description Candidates should understand the principle of major types of security vulnerabilities and threats.

Key Knowledge Areas:

  • Conceptual understanding of threats against individual nodes
  • Conceptual understanding of threats against networks
  • Conceptual understanding of threats against application
  • Conceptual understanding of threats against credentials and confidentiality
  • Conceptual understanding of honeypots

The following is a partial list of the used files, terms and utilities:

  • Trojans
  • Viruses
  • Rootkits
  • Keylogger
  • DoS and DDoS
  • Man in the Middle
  • ARP and NDP forgery
  • Rogue Access Points, Routers and DHCP servers
  • Link layer address and IP address spoofing
  • Buffer Overflows
  • SQL and Code Injections
  • Cross Site Scripting
  • Cross Site Request Forgery
  • Privilege escalation
  • Brute Force Attacks
  • Rainbow tables
  • Phishing
  • Social Engineering


335.2 Penetration Testing (weight: 3)

Weight 3
Description Candidates understand the concepts of penetration testing, including an understand of commonly used penetration testing tools. Furthermore, candidates should be able to use nmap to verify the effectiveness of network security measures.

Key Knowledge Areas:

  • Understand the concepts of penetration testing and ethical hacking
  • Understand legal implications of penetration testing
  • Understand the phases of penetration tests, such as active and passive information gathering, enumeration, gaining access, privilege escalation, access maintenance, covering tracks
  • Understand the architecture and components of Metasploit, including Metasploit module types and how Metasploit integrates various security tools
  • Use nmap to scan networks and hosts, including different scan methods, version scans and operating system recognition
  • Understand the concepts of Nmap Scripting Engine and execute existing scripts
  • Awareness of Kali Linux, Armitage and the Social Engineer Toolkit (SET)

Partial list of the used files, terms and utilities:

  • nmap


Future Change Considerations

  • Future changes to the objective will/may include:
  • Advanced sudo configuration is absent
  • Awareness/knowledge of the LSM framework would be nice to add (SElinux and Apparmor/Smack are mentioned but there are more than that)
  • Advanced configuration/usage of filesystems (btrfs, ext4, xfs, nfs, etc) deserve a place in LPIC-303
  • Namespaces are absent
  • nmap should get moved to Topic 334: Network Security
  • The whole 335.2 Penetration Testing is a bit out of place in my opinion. I would prefer a section about compliance with GDPR, NIST, HIPAA, etc, instead (at awareness level)
  • There is no mention of the kernel and kernel modules (blacklisting, module parameter configuration, etc)
Retrieved from "https://wiki.lpi.org/pubwiki/index.php?title=LPIC-303_Objectives_V3.0&oldid=5845"