LPIC-303 Objectives V3.0(JA) - Revision history

FabianThorns: /* 334.2 ネットワーク侵入検知 (総重量: 4) */

2021-07-11T10:57:01Z

334.2 ネットワーク侵入検知 (総重量: 4)

← Older revision		Revision as of 10:57, 11 July 2021
Line 343:		Line 343:
	* snort		* snort
	* snort-stat		* snort-stat
			* pulledpork.pl
	* /etc/snort/*		* /etc/snort/*
	* openvas-adduser,		* openvas-adduser,
Line 349:		Line 350:
	* openvassd		* openvassd
	* openvas-mkcert		* openvas-mkcert
			* openvas-feed-update
	* /etc/openvas/*		* /etc/openvas/*

Okadaknj at 12:53, 1 March 2020

2020-03-01T12:53:16Z

← Older revision		Revision as of 12:53, 1 March 2020
Line 1:		Line 1:
	__FORCETOC__		__FORCETOC__
	==はじめに==		==はじめに==
	~~ここ修正！！これは、~~ [[LPIC-~~3認定試験~~]]LPIC-~~3認定試験[~~LPIC-3~~\|here~~]]に必要な項目です。		[[LPIC-3\|これ]]は、[[LPIC-3\|LPIC-3 認定試験]]に必要な項目です。
	<br />		<br />
	<br />		<br />

Okadaknj at 12:52, 1 March 2020

2020-03-01T12:52:22Z

Show changes

Okadaknj at 07:46, 1 March 2020

2020-03-01T07:46:06Z

← Older revision		Revision as of 07:46, 1 March 2020
Line 214:		Line 214:
	\|-		\|-
	\| style="background:#dadada; padding-right:1em" \| '''説明'''		\| style="background:#dadada; padding-right:1em" \| '''説明'''
	\| style="background:#eaeaea" \| ~~Candidates should be able to restrict the resources services and programs can consume.~~		\| style="background:#eaeaea" \| サービスとプログラムが利用可能なリソースを制限できる。
	\|}		\|}
	'''~~Key Knowledge Areas~~:'''		'''主な知識分野:'''
	* ~~Understand and configure ulimits~~		* ulimitsの理解と設定
	* ~~Understand cgroups, including classes, limits and accounting~~		* クラス・リミット・アカウンティングを含むcgroupsの理解。
	* ~~Manage cgroups and process cgroup association~~		* cgroupsの管理と、cgroup associationの加工。
	* ~~Understand systemd resource control, including slices~~		* スライスを含む、systemdリソース制御の理解
	* ~~Configure resource limits in systemd units~~		* systemdユニットのリソース制限の設定。
	* ~~Awareness of cgmanager and libcgroup utilities~~		* cgmanagerとlibcgroupユーティリティーの知識。
	'''~~Partial list of the used files, terms and utilities~~:'''		'''用語とユーティリティ:'''
	* ulimit		* ulimit
	* /etc/security/limits.conf		* /etc/security/limits.conf
Line 234:		Line 234:
	<br />		<br />

	===''~~Topic~~ 333: Access Control''===		===''課題 333: Access Control''===
	====<span style="color:navy">333.1 ~~Discretionary Access Control~~ (~~weight~~: 3)</span>====		====<span style="color:navy">333.1 任意アクセス制御 (総重量: 3)</span>====
	{\|		{\|
	\| style="background:#dadada" \| '''~~Weight~~'''		\| style="background:#dadada" \| '''総重量'''
	\| style="background:#eaeaea" \| 3		\| style="background:#eaeaea" \| 3
	\|-		\|-
	\| style="background:#dadada; padding-right:1em" \| '''~~Description~~'''		\| style="background:#dadada; padding-right:1em" \| '''説明'''
	\| style="background:#eaeaea" \| ~~Candidates should understand~~ discretionary access control (~~DAC) and know how to implement it using~~ access control ~~lists (ACL~~)~~. Additionally, candidates are required to understand and know how to use extended attributes.~~		\| style="background:#eaeaea" \| 任意アクセス制御(DAC: discretionary access control)を理解していて、アクセス制御リスト(ACL: access control list)を利用してどのように実装するかの知識があります。さらに、拡張された属性をどのように利用するかを理解しているひつようがあります。
	\|}		\|}
	'''~~Key Knowledge Areas~~:'''		'''主な知識分野:'''
	* ~~Understand and manage file ownership and permissions~~, ~~including SetUID and SetGID bits~~		* SetUID, SetGIDビットを含む、ファイルの所有権・パーミッションの管理と理解。
	* ~~Understand and manage access control lists~~		* アクセス制御リスト(ACL)の管理と理解。
	* ~~Understand and manage extended attributes and attribute classes~~		* 拡張属性と属性クラスの管理と理解。
	'''~~Partial list of the used files, terms and utilities~~:'''		'''用語とユーティリティ:'''
	* getfacl		* getfacl
	* setfacl		* setfacl

Okadaknj at 07:41, 1 March 2020

2020-03-01T07:41:03Z

← Older revision		Revision as of 07:41, 1 March 2020
Line 129:		Line 129:
	<br />		<br />

	===''~~Topic~~ 332: ~~Host Security~~''===		===''課題 332: ホストセキュリティ''===

	====<span style="color:navy">332.1 ~~Host Hardening~~ (~~weight~~: 5)</span>====		====<span style="color:navy">332.1 ホストハードニング (総重量: 5)</span>====
	{\|		{\|
	\| style="background:#dadada" \| '''~~Weight~~'''		\| style="background:#dadada" \| '''総重量'''
	\| style="background:#eaeaea" \| 5		\| style="background:#eaeaea" \| 5
	\|-		\|-
	\| style="background:#dadada; padding-right:1em" \| '''~~Description~~'''		\| style="background:#dadada; padding-right:1em" \| '''説明'''
	\| style="background:#eaeaea" \| ~~Candidates should be able to secure computers running Linux against common threats.~~		\| style="background:#eaeaea" \| 一般的な脅威に対して、Linuxが稼働しているコンピュータをよりセキュアにする。
	\|}		\|}
	'''~~Key Knowledge Areas~~:'''		'''主な知識分野:'''
	* ~~Configure BIOS and boot~~ loader (GRUB 2) ~~security~~		* BIOSとboot loader(GRUB 2)セキュリティの設定。
	* ~~Disable unused software and services~~		* 利用していないソフトウエアとサービスを無効化する。
	* ~~Understand and drop unnecessary capabilities for specific systemd units and the entire system~~		* 特定のsystemdユニットと全体システムに対して、不必要な機能を理解し削除する。
	* ~~Understand and configure~~ Address Space Layout Randomization ~~(ASLR~~)~~, Data~~ Execution Prevention (DEP) ~~and~~ Exec-~~Shield~~		* アドレス空間のランダム化(ASLR: Address Space Layout Randomization )、Data Execution Prevention (DEP) 、 Exec-Shieldを理解し設定する。
	* ~~Black and white list USB devices attached to a computer using USBGuard~~		* ブラックリスト・ホワイトリストに分けられたUSBデバイスを、USBGuardを利用して、コンピュータに接続する。
	* ~~Create an SSH CA, create SSH certificates for host and user keys using the CA and configure OpenSSH to use SSH certificates~~		* CAを利用してホストとユーザーキーのSSH CA、SSH証明書を作成し、OpenSSHがSSH証明書を利用するように設定する。
	* ~~Work with chroot environments~~		* chroot環境での作業
	* ~~Use systemd units to limit the system calls and capabilities available to a process~~		* システムコールとプロセスに対して有効な機能を制限するために、systemdユニットを利用する。
	* ~~Use systemd units to start processes with limited or no access to specific files and devices~~		* 特定のファイルやデバイスに、アクセスを制限したりアクセスさせないようにして、プロセスを起動するようにsystemdユニットを利用する。
	* ~~Use systemd units to start processes with dedicated temporary and~~ /~~dev directories and without network access~~		* 専用のテンポラリディレクトリや/devディレクトリがあり、ネットワークアクセスができない状態のプロセスを起動するように、systemdユニットを利用する。
	* ~~Use systemd units to limit the system resources a process can consume~~		* プロセスが消費することができるシステムリソースを制限するように、systemdユニットを利用することができる。
	* ~~Understand the implications of~~ Linux ~~Meltdown and Spectre mitigations and enable/disable the mitigations~~		* Linux MeltdownとSpectreの回避策の影響の理解と、回避策の有効化・無効化。
	* ~~Awareness of polkit~~		* polkitの知識
	* ~~Awareness of the security advantages of virtualization and containerization~~		* 仮想化とコンテナ化のセキュリティの利点の知識
	'''~~The following is a partial list of the used files, terms and utilities~~:'''		'''用語とユーティリティ:'''
	* grub.cfg		* grub.cfg
	* systemctl		* systemctl
Line 172:		Line 172:
	<br />		<br />

	====<span style="color:navy">332.2 ~~Host Intrusion Detection~~ (~~weight~~: 5)</span>====		====<span style="color:navy">332.2 ホストの侵入検知 (総重量: 5)</span>====
	{\|		{\|
	\| style="background:#dadada" \| '''~~Weight~~'''		\| style="background:#dadada" \| '''総重量'''
	\| style="background:#eaeaea" \| 5		\| style="background:#eaeaea" \| 5
	\|-		\|-
	\| style="background:#dadada; padding-right:1em" \| '''~~Description~~'''		\| style="background:#dadada; padding-right:1em" \| '''説明'''
	\| style="background:#eaeaea" \| ~~Candidates should be familiar with the use and configuration of common host intrusion detection software. This includes managing the Linux Audit system and verifying a system's integrity.~~		\| style="background:#eaeaea" \| 一般的なのホスト侵入検知ソフトウエアの利用と設定の知識がある必要がある。これには、Linux Auditシステムとシステムの一貫性の検証が含まれる。
	\|}		\|}
	'''~~Key Knowledge Areas~~:'''		'''主な知識分野:'''
	* ~~Use and configure the~~ Linux ~~Audit system~~		* Linux Auditシステムの設定と利用
	* ~~Use chkrootkit~~		* chkrootkitの利用
	* ~~Use and configure rkhunter, including updates~~		* rkhunterの、利用・設定・アップデート
	* ~~Use~~ Linux Malware Detect		* Linux Malware Detect(マルウェア検出ツール）の利用。
	* ~~Automate host scans using cron~~		* cronを利用したホストのスキャンの自動化。
	* ~~Use RPM and DPKG package management tools to verify the integrity of installed files~~		* インストールされたファイルの一貫性の検証のため、RPMやDPKGのパッケージ管理ツールの利用。
	* ~~Configure and use AIDE, including rule management~~		* ルール管理を含んだAIDEの設定と利用。
	* ~~Awareness of OpenSCAP~~		* OpenSCAPの知識
	'''~~Partial list of the used files, terms and utilities~~:'''		'''用語とユーティリティ:'''
	* auditd		* auditd
	* auditctl		* auditctl
Line 208:		Line 208:
	<br />		<br />

	====<span style="color:navy">332.3 ~~Resource Control~~ (~~weight~~: 3)</span>====		====<span style="color:navy">332.3 リソース制御 (総重量: 3)</span>====
	{\|		{\|
	\| style="background:#dadada" \| '''~~Weight~~'''		\| style="background:#dadada" \| '''総重量'''
	\| style="background:#eaeaea" \| 3		\| style="background:#eaeaea" \| 3
	\|-		\|-
	\| style="background:#dadada; padding-right:1em" \| '''~~Description~~'''		\| style="background:#dadada; padding-right:1em" \| '''説明'''
	\| style="background:#eaeaea" \| Candidates should be able to restrict the resources services and programs can consume.		\| style="background:#eaeaea" \| Candidates should be able to restrict the resources services and programs can consume.
	\|}		\|}

Okadaknj at 07:09, 1 March 2020

2020-03-01T07:09:48Z

← Older revision		Revision as of 07:09, 1 March 2020
Line 1:		Line 1:
	__FORCETOC__		__FORCETOC__
	==はじめに==		==はじめに==
	~~これは、~~ [[LPIC-3認定試験]]LPIC-3認定試験[LPIC-3\|here]]に必要な項目です。		ここ修正！！これは、 [[LPIC-3認定試験]]LPIC-3認定試験[LPIC-3\|here]]に必要な項目です。
	<br />		<br />
	<br />		<br />
Line 70:		Line 70:
	<br />		<br />

	====<span style="color:navy">331.3 ~~Encrypted File Systems~~ (~~weight~~: 3)</span>====		====<span style="color:navy">331.3 暗号化ファイルシステム (総重量: 3)</span>====
	{\|		{\|
	\| style="background:#dadada" \| '''~~Weight~~'''		\| style="background:#dadada" \| '''総重量'''
	\| style="background:#eaeaea" \| 3		\| style="background:#eaeaea" \| 3
	\|-		\|-
	\| style="background:#dadada; padding-right:1em" \| '''~~Description~~'''		\| style="background:#dadada; padding-right:1em" \| '''説明'''
	\| style="background:#eaeaea" \| ~~Candidates should be able to set up and configure encrypted file systems.~~		\| style="background:#eaeaea" \| 暗号化ファイルシステムを構築し設定できる。
	\|}		\|}
	'''~~Key Knowledge Areas~~:'''		'''主な知識分野:'''
	* ~~Understand block device and file system encryption~~		* ブロックデバイスとファイルシステム暗号化を理解する。
	* ~~Use dm~~-~~crypt with LUKS1 to encrypt block devices~~		* ブロックデバイスを暗号化するために、LUKS1によるdm-cryptを利用する。
	* ~~Use eCryptfs to encrypt file systems, including home directories and PAM integration~~		* ファイルシステムを暗号化するために、eCryptfsを利用する。これには、ホームディレクトリとPAM統合を含まれる。
	* ~~Awareness of plain dm~~-~~crypt~~		* plainモードのdm-cryptの知識
	* ~~Awareness of LUKS2 features~~		* LUKS2機能の知識
	* ~~Conceptual understanding of Clevis for LUKS devices and Clevis PINs for TMP2 and Network~~ Bound Disk Encryption (NBDE)/~~Tang~~		* LUKSデバイスのClevisと、TMP2とNetwork Bound Disk Encryption (NBDE)/TangのClevis PINの概念的な理解。
	'''~~The following is a partial list of the used files, terms and utilities~~:'''		'''用語とユーティリティ:'''
	* cryptsetup (~~including relevant subcommands~~)		* cryptsetup (関連するサブコマンドを含む)
	* cryptmount		* cryptmount
	* /etc/crypttab		* /etc/crypttab
Line 96:		Line 96:
	<br />		<br />

	====<span style="color:navy">331.4 ~~DNS and Cryptography~~ (~~weight~~: 5)</span>====		====<span style="color:navy">331.4 DNSと暗号化 (総重量: 5)</span>====
	{\|		{\|
	\| style="background:#dadada" \| '''~~Weight~~'''		\| style="background:#dadada" \| '''総重量'''
	\| style="background:#eaeaea" \| 5		\| style="background:#eaeaea" \| 5
	\|-		\|-
	\| style="background:#dadada; padding-right:1em" \| '''~~Description~~'''		\| style="background:#dadada; padding-right:1em" \| '''説明'''
	\| style="background:#eaeaea" \| ~~Candidates should have experience and knowledge of cryptography in the context of DNS and its implementation using BIND. The version of BIND covered is 9.7 or higher~~.		\| style="background:#eaeaea" \| BINDを利用した際の、DNSの背景と実装について、暗号化の知識と経験がある。BINDのバージョンは9.7とそれ以上を対象としている。
	\|}		\|}
	'''~~Key Knowledge Areas~~:'''		'''主な知識分野:'''
	* ~~Understand the concepts of DNS, zones and resource records~~		* DNS・ゾーン・リソースレコードの概念を理解している。
	* ~~Understand DNSSEC, including key signing keys, zone signing keys and relevant DNS records such as DS~~, DNSKEY, RRSIG, NSEC, NSEC3		* 鍵署名鍵、ゾーン署名鍵、DS, DNSKEY, RRSIG, NSEC, NSEC3, NSEC3PARAMなどの関連するDNSレコードを含み、DNSSECを理解している。
	~~and NSEC3PARAM~~		* DNSSECセキュアゾーンを提供している権威のあるネームサーバとしての、BINDの設定をトラブルシューティング。
	* ~~Configure and troubleshoot BIND as an authoritative name server serving DNSSEC secured zones~~		* DNSSECの署名されたゾーンを管理する。これには、キー生成・キーのロールオーバー・ゾーンの再署名が含まれます。
	* ~~Manage DNSSEC signed zones, including key generation, key rollover and re-signing of zones~~		* クライアントの振る舞いがDNSSECバリデーションとして機能する、再帰ネームサーバとしてBINDを設定する。
	* ~~Configure BIND as an recursive name server that performs DNSSEC validation on behalf of its clients~~		* CAAやTLSAのようなDNSレコードに関連する、CAAとDANEの理解。
	* ~~Understand CAA and DANE, including relevant DNS records such as CAA and TLSA~~		* DNSで、X.509証明書と認証局/CAの情報を発行する、CAAとDANEを利用する。
	* ~~Use CAA and DANE to publish X~~.~~509 certificate and certificate authority information in DNS~~		* BINDでセキュアな接続を行うため、TSIGを利用する。
	* ~~Use TSIG for secure communication with BIND~~		* DNS over TLSとDNS over HTTPSの知識。
	* ~~Awareness of~~ DNS over ~~TLS and DNS~~ over ~~HTTPS~~		* マルチキャストDNSの知識。
	* ~~Awareness of Multicast DNS~~		'''用語とユーティリティ:'''
	'''~~Partial list of the used files, terms and utilities~~:'''
	* named.conf		* named.conf
	* dnssec-keygen		* dnssec-keygen
Line 122:		Line 121:
	* dnssec-settime		* dnssec-settime
	* dnssec-dsfromkey		* dnssec-dsfromkey
	* rndc (~~including relevant subcommands~~)		* rndc (関連するサブコマンドを含む)
	* dig		* dig
	* delv		* delv
	* openssl (~~including relevant subcommands~~)		* openssl (関連するサブコマンドを含む)

	<br />		<br />

Okadaknj at 07:03, 1 March 2020

2020-03-01T07:03:26Z

← Older revision		Revision as of 07:03, 1 March 2020
Line 1:		Line 1:
	__FORCETOC__		__FORCETOC__
	==はじめに==		==はじめに==
	これは、 [[LPIC-3]]LPIC-3認定試験[LPIC-3\|here]]に必要な項目です。		これは、 [[LPIC-3認定試験]]LPIC-3認定試験[LPIC-3\|here]]に必要な項目です。
	<br />		<br />
	<br />		<br />

Okadaknj at 07:02, 1 March 2020

2020-03-01T07:02:33Z

← Older revision		Revision as of 07:02, 1 March 2020
Line 21:		Line 21:
	==試験範囲==		==試験範囲==
	===''課題 331: 暗号化''===		===''課題 331: 暗号化''===
	====<span style="color:navy">331.1 X.~~509 Certificates and Public Key Infrastructures~~ (~~weight~~: 5)</span>====		====<span style="color:navy">331.1 X.509証明書と公開鍵基盤 (総重量: 5)</span>====
	{\|		{\|
	\| style="background:#dadada" \| '''~~Weight~~'''		\| style="background:#dadada" \| '''総重量'''
	\| style="background:#eaeaea" \| 5		\| style="background:#eaeaea" \| 5
	\|-		\|-
	\| style="background:#dadada; padding-right:1em" \| '''~~Description~~'''		\| style="background:#dadada; padding-right:1em" \| '''説明'''
	\| style="background:#eaeaea" \| ~~Candidates should understand~~ X.~~509 certificates and public key infrastructures. They should know how to configure and use OpenSSL to implement certification authorities and issue SSL certificates for various purposes.~~		\| style="background:#eaeaea" \| X.509証明書と公開鍵基盤を理解している必要がある。認証局/CAを実装するのために、OpenSSLを設定し利用したり、様々な目的のために、SSL証明書を発行することを知っている必要があります。
	\|}		\|}
	'''~~Key Knowledge Areas~~:'''		'''主な知識分野:'''
	* ~~Understand~~ X.~~509 certificates, X~~.~~509 certificate lifecycle, X~~.~~509 certificate fields and X~~.~~509v3 certificate extensions~~		* X.509証明書、X.509証明書のライフサイクル、X.509証明書のフィールドとX.509v3証明書拡張を理解している。
	* ~~Understand~~ trust chains ~~and public key infrastructures, including certificate transparency~~		* 証明書の透明性(CT: certificate transparency)を含む、信頼の連鎖(trust chains)と公開鍵基盤を理解している。
	* ~~Generate and manage public and private keys~~		* 公開鍵と秘密鍵の生成と管理。
	* ~~Create, operate and secure a certification authority~~		* 認証局/CAを作成・操作・厳重に管理する。
	* ~~Request, sign and manage server and client certificates~~		* サーバ・クライアント証明書を、要求・署名・管理する。
	* ~~Revoke certificates and certification authorities~~		* 証明書と認証局/CAを無効にする。
	* ~~Basic feature knowledge of~~ Let's Encrypt, ACME ~~and certbot~~		* Let's Encrypt, ACME, certbotの基本的な特徴の知識。
	* ~~Basic feature knowledge of CFSSL~~		* CFSSLの基本的な特徴の知識。
	'''~~Partial list of the used files, terms and utilities~~:'''		'''用語とユーティリティ:'''
	* openssl (~~including relevant subcommands~~)		* openssl (関連するサブコマンドを含む)
	* ~~OpenSSL configuration~~		* OpenSSLの設定
	* PEM, DER, PKCS		* PEM, DER, PKCS
	* CSR		* CSR
Line 48:		Line 48:
	<br />		<br />

	====<span style="color:navy">331.2 X.~~509 Certificates for Encryption, Signing and Authentication~~ (~~weight~~: 4)</span>====		====<span style="color:navy">331.2 暗号化・署名・認証のためのX.509証明書 (総重量: 4)</span>====
	{\|		{\|
	\| style="background:#dadada" \| '''~~Weight~~'''		\| style="background:#dadada" \| '''総重量'''
	\| style="background:#eaeaea" \| 4		\| style="background:#eaeaea" \| 4
	\|-		\|-
	\| style="background:#dadada; padding-right:1em" \| '''~~Description~~'''		\| style="background:#dadada; padding-right:1em" \| '''説明'''
	\| style="background:#eaeaea" \| ~~Candidates should be able to use X~~.~~509 certificates for both server and client authentication. This includes implementing user and server authentication for Apache HTTPD. The version of Apache HTTPD covered is 2.4 or higher~~.		\| style="background:#eaeaea" \| サーバ・クライアント認証両方のために、X.509証明書を利用することができる。これには、Apache HTTPDのユーザとサーバ認証の実装が含まれる。Apache HTTPDのバージョンは2.4以上を対象としている。
	\|}		\|}
	'''~~Key Knowledge Areas~~:'''		'''主な知識分野:'''
	* ~~Understand SSL, TLS~~, ~~including protocol versions and ciphers~~		* プロトコルバージョンと暗号(cipher)を含む、SSL, TLSの理解。
	* ~~Configure~~ Apache ~~HTTPD with mod_ssl to provide HTTPS service~~, ~~including SNI and HSTS~~		* Apache HTTPDのmod_sslを利用して、SNI, HSTSを含む、HTTPSサービスを提供できるように設定する。
	* ~~Configure Apache HTTPD with mod_ssl to serve certificate chains and adjust the cipher configuration (no cipher-specific knowledge)~~		* 証明書の連鎖を提供し、cipherの設定を調節して、Apache HTTPDのmod_sslを設定する（cipherに特化した知識ではない）。
	* ~~Configure Apache HTTPD with mod_ssl to authenticate users using certificates~~		* 証明書を利用して、ユーザ認証をするようにApache HTTPDのmod_sslをせっていする。
	* ~~Configure Apache HTTPD with mod_ssl to provide OCSP stapling~~		* OCSPを提供するように、Apache HTTPDのmod_sslを設定する。
	* ~~Use OpenSSL for SSL~~/~~TLS client and server tests~~		* OpenSSLを、SSL/TLSクライアントとサーバのテストに利用する。
	'''~~Partial list of the used files, terms and utilities~~:'''		'''用語とユーティリティ:'''
	* httpd.conf		* httpd.conf
	* mod_ssl		* mod_ssl
	* openssl (~~including relevant subcommands~~)		* openssl (関連するサブコマンドを含む)

	<br />		<br />

Okadaknj: Created page with "FORCETOC ==はじめに== これは、 LPIC-3LPIC-3認定試験[LPIC-3|here]]に必要な項目です。

==バージョン情報== の試験範囲は..."

2020-03-01T06:54:39Z

Created page with "__FORCETOC__ ==はじめに== これは、 LPIC-3LPIC-3認定試験[LPIC-3|here]]に必要な項目です。 ==バージョン情報== の試験範囲は..."

New page

__FORCETOC__
==はじめに==
これは、 [[LPIC-3]]LPIC-3認定試験[LPIC-3|here]]に必要な項目です。
 
 

==バージョン情報==

の試験範囲は、バージョン3.0.0です。

以前の [[LPIC-303 Objectives V2|バージョン2.0]] の試験範囲は [[LPIC-303 Objectives V2|こちら]]。

 

==試験範囲の翻訳==
このwikiに、以下の試験範囲の翻訳があります:
* [[LPIC-303_Objectives_V3.0|英語]]
* [[LPIC-303_Objectives_V3.0(JA)|日本語]]
 

==試験範囲==
===''課題 331: 暗号化''===
====331.1 X.509 Certificates and Public Key Infrastructures (weight: 5)====
{|
| style="background:#dadada" | '''Weight'''
| style="background:#eaeaea" | 5
|-
| style="background:#dadada; padding-right:1em" | '''Description'''
| style="background:#eaeaea" | Candidates should understand X.509 certificates and public key infrastructures. They should know how to configure and use OpenSSL to implement certification authorities and issue SSL certificates for various purposes.
|}
'''Key Knowledge Areas:'''
* Understand X.509 certificates, X.509 certificate lifecycle, X.509 certificate fields and X.509v3 certificate extensions
* Understand trust chains and public key infrastructures, including certificate transparency
* Generate and manage public and private keys
* Create, operate and secure a certification authority
* Request, sign and manage server and client certificates
* Revoke certificates and certification authorities
* Basic feature knowledge of Let's Encrypt, ACME and certbot
* Basic feature knowledge of CFSSL
'''Partial list of the used files, terms and utilities:'''
* openssl (including relevant subcommands)
* OpenSSL configuration
* PEM, DER, PKCS
* CSR
* CRL
* OCSP

 

====331.2 X.509 Certificates for Encryption, Signing and Authentication (weight: 4)====
{|
| style="background:#dadada" | '''Weight'''
| style="background:#eaeaea" | 4
|-
| style="background:#dadada; padding-right:1em" | '''Description'''
| style="background:#eaeaea" | Candidates should be able to use X.509 certificates for both server and client authentication. This includes implementing user and server authentication for Apache HTTPD. The version of Apache HTTPD covered is 2.4 or higher.
|}
'''Key Knowledge Areas:'''
* Understand SSL, TLS, including protocol versions and ciphers
* Configure Apache HTTPD with mod_ssl to provide HTTPS service, including SNI and HSTS
* Configure Apache HTTPD with mod_ssl to serve certificate chains and adjust the cipher configuration (no cipher-specific knowledge)
* Configure Apache HTTPD with mod_ssl to authenticate users using certificates
* Configure Apache HTTPD with mod_ssl to provide OCSP stapling
* Use OpenSSL for SSL/TLS client and server tests
'''Partial list of the used files, terms and utilities:'''
* httpd.conf
* mod_ssl
* openssl (including relevant subcommands)

 

====331.3 Encrypted File Systems (weight: 3)====
{|
| style="background:#dadada" | '''Weight'''
| style="background:#eaeaea" | 3
|-
| style="background:#dadada; padding-right:1em" | '''Description'''
| style="background:#eaeaea" | Candidates should be able to set up and configure encrypted file systems.
|}
'''Key Knowledge Areas:'''
* Understand block device and file system encryption
* Use dm-crypt with LUKS1 to encrypt block devices
* Use eCryptfs to encrypt file systems, including home directories and PAM integration
* Awareness of plain dm-crypt
* Awareness of LUKS2 features
* Conceptual understanding of Clevis for LUKS devices and Clevis PINs for TMP2 and Network Bound Disk Encryption (NBDE)/Tang
'''The following is a partial list of the used files, terms and utilities:'''
* cryptsetup (including relevant subcommands)
* cryptmount
* /etc/crypttab
* ecryptfsd
* ecryptfs-* commands
* mount.ecryptfs, umount.ecryptfs
* pam_ecryptfs

 

====331.4 DNS and Cryptography (weight: 5)====
{|
| style="background:#dadada" | '''Weight'''
| style="background:#eaeaea" | 5
|-
| style="background:#dadada; padding-right:1em" | '''Description'''
| style="background:#eaeaea" | Candidates should have experience and knowledge of cryptography in the context of DNS and its implementation using BIND. The version of BIND covered is 9.7 or higher.
|}
'''Key Knowledge Areas:'''
* Understand the concepts of DNS, zones and resource records
* Understand DNSSEC, including key signing keys, zone signing keys and relevant DNS records such as DS, DNSKEY, RRSIG, NSEC, NSEC3
and NSEC3PARAM
* Configure and troubleshoot BIND as an authoritative name server serving DNSSEC secured zones
* Manage DNSSEC signed zones, including key generation, key rollover and re-signing of zones
* Configure BIND as an recursive name server that performs DNSSEC validation on behalf of its clients
* Understand CAA and DANE, including relevant DNS records such as CAA and TLSA
* Use CAA and DANE to publish X.509 certificate and certificate authority information in DNS
* Use TSIG for secure communication with BIND
* Awareness of DNS over TLS and DNS over HTTPS
* Awareness of Multicast DNS
'''Partial list of the used files, terms and utilities:'''
* named.conf
* dnssec-keygen
* dnssec-signzone
* dnssec-settime
* dnssec-dsfromkey
* rndc (including relevant subcommands)
* dig
* delv
* openssl (including relevant subcommands)

 
 

===''Topic 332: Host Security''===

====332.1 Host Hardening (weight: 5)====
{|
| style="background:#dadada" | '''Weight'''
| style="background:#eaeaea" | 5
|-
| style="background:#dadada; padding-right:1em" | '''Description'''
| style="background:#eaeaea" | Candidates should be able to secure computers running Linux against common threats.
|}
'''Key Knowledge Areas:'''
* Configure BIOS and boot loader (GRUB 2) security
* Disable unused software and services
* Understand and drop unnecessary capabilities for specific systemd units and the entire system
* Understand and configure Address Space Layout Randomization (ASLR), Data Execution Prevention (DEP) and Exec-Shield
* Black and white list USB devices attached to a computer using USBGuard
* Create an SSH CA, create SSH certificates for host and user keys using the CA and configure OpenSSH to use SSH certificates
* Work with chroot environments
* Use systemd units to limit the system calls and capabilities available to a process
* Use systemd units to start processes with limited or no access to specific files and devices
* Use systemd units to start processes with dedicated temporary and /dev directories and without network access
* Use systemd units to limit the system resources a process can consume
* Understand the implications of Linux Meltdown and Spectre mitigations and enable/disable the mitigations
* Awareness of polkit
* Awareness of the security advantages of virtualization and containerization
'''The following is a partial list of the used files, terms and utilities:'''
* grub.cfg
* systemctl
* getcap
* setcap
* capsh
* sysctl
* /etc/sysctl.conf
* /etc/usbguard/usbguard-daemon.conf
* /etc/usbguard/rules.conf
* usbguard
* ssh-keygen
* /etc/ssh/
* ~/.ssh/
* /etc/ssh/sshd_config
* chroot
 

====332.2 Host Intrusion Detection (weight: 5)====
{|
| style="background:#dadada" | '''Weight'''
| style="background:#eaeaea" | 5
|-
| style="background:#dadada; padding-right:1em" | '''Description'''
| style="background:#eaeaea" | Candidates should be familiar with the use and configuration of common host intrusion detection software. This includes managing the Linux Audit system and verifying a system's integrity.
|}
'''Key Knowledge Areas:'''
* Use and configure the Linux Audit system
* Use chkrootkit
* Use and configure rkhunter, including updates
* Use Linux Malware Detect
* Automate host scans using cron
* Use RPM and DPKG package management tools to verify the integrity of installed files
* Configure and use AIDE, including rule management
* Awareness of OpenSCAP
'''Partial list of the used files, terms and utilities:'''
* auditd
* auditctl
* ausearch, aureport
* auditd.conf
* audit.rules
* pam_tty_audit.so
* chkrootkit
* rkhunter
* /etc/rkhunter.conf
* maldet
* conf.maldet
* rpm
* dpkg
* aide
* /etc/aide/aide.conf

 

====332.3 Resource Control (weight: 3)====
{|
| style="background:#dadada" | '''Weight'''
| style="background:#eaeaea" | 3
|-
| style="background:#dadada; padding-right:1em" | '''Description'''
| style="background:#eaeaea" | Candidates should be able to restrict the resources services and programs can consume.
|}
'''Key Knowledge Areas:'''
* Understand and configure ulimits
* Understand cgroups, including classes, limits and accounting
* Manage cgroups and process cgroup association
* Understand systemd resource control, including slices
* Configure resource limits in systemd units
* Awareness of cgmanager and libcgroup utilities
'''Partial list of the used files, terms and utilities:'''
* ulimit
* /etc/security/limits.conf
* pam_limits.so
* /sys/fs/group/
* /proc/cgroups
* systemd-cgls
* systemd-cgtop
 
 

===''Topic 333: Access Control''===
====333.1 Discretionary Access Control (weight: 3)====
{|
| style="background:#dadada" | '''Weight'''
| style="background:#eaeaea" | 3
|-
| style="background:#dadada; padding-right:1em" | '''Description'''
| style="background:#eaeaea" | Candidates should understand discretionary access control (DAC) and know how to implement it using access control lists (ACL). Additionally, candidates are required to understand and know how to use extended attributes.
|}
'''Key Knowledge Areas:'''
* Understand and manage file ownership and permissions, including SetUID and SetGID bits
* Understand and manage access control lists
* Understand and manage extended attributes and attribute classes
'''Partial list of the used files, terms and utilities:'''
* getfacl
* setfacl
* getfattr
* setfattr

 

====333.2 Mandatory Access Control (weight: 5)====
{|
| style="background:#dadada" | '''Weight'''
| style="background:#eaeaea" | 5
|-
| style="background:#dadada; padding-right:1em" | '''Description'''
| style="background:#eaeaea" | Candidates should be familiar with mandatory access control (MAC) systems for Linux. Specifically, candidates should have a thorough knowledge of SELinux. Also, candidates should be aware of other mandatory access control systems for Linux. This includes major features of these systems but not configuration and use.
|}
'''Key Knowledge Areas:'''
* Understand the concepts of type enforcement, role based access control, mandatory access control and discretionary access control
* Configure, manage and use SELinux
* Awareness of AppArmor and Smack
'''Partial list of the used files, terms and utilities:'''
* getenforce
* setenforce
* selinuxenabled
* getsebool
* setsebool
* togglesebool
* fixfiles
* restorecon
* setfiles
* newrole
* setcon
* runcon
* chcon
* semanage
* sestatus
* seinfo
* apol
* seaudit
* audit2why
* audit2allow
* /etc/selinux/*

 

 

===''Topic 334: Network Security''===
====334.1 Network Hardening (weight: 4)====
{|
| style="background:#dadada" | '''Weight'''
| style="background:#eaeaea" | 4
|-
| style="background:#dadada; padding-right:1em" | '''Description'''
| style="background:#eaeaea" | Candidates should be able to secure networks against common threats. This includes analyzing network traffic of specific nodes and protocols.
|}
'''Key Knowledge Areas:'''
* Understand wireless networks security mechanisms
* Configure FreeRADIUS to authenticate network nodes
* Use Wireshark and tcpdump to analyze network traffic, including filters and statistics
* Use Kismet to analyze wireless networks and capture wireless network traffic
* Identify and deal with rogue router advertisements and DHCP messages
* Awareness of aircrack-ng and bettercap
'''The following is a partial list of the used files, terms and utilities:'''
* radiusd
* radmin
* radtest
* radclient
* radlast
* radwho
* radiusd.conf
* /etc/raddb/*
* wireshark
* tshark
* tcpdump
* kismet
* ndpmon

 

====334.2 Network Intrusion Detection (weight: 4)====
{|
| style="background:#dadada" | '''Weight'''
| style="background:#eaeaea" | 4
|-
| style="background:#dadada; padding-right:1em" | '''Description'''
| style="background:#eaeaea" | Candidates should be familiar with the use and configuration of network security scanning, network monitoring and network intrusion detection software. This includes updating and maintaining the security scanners.
|}
'''Key Knowledge Areas:'''
* Implement bandwidth usage monitoring
* Configure and use Snort, including rule management
* Configure and use OpenVAS, including NASL
'''Partial list of the used files, terms and utilities:'''
* ntop
* snort
* snort-stat
* /etc/snort/*
* openvas-adduser,
* openvas-rmuser
* openvas-nvt-sync
* openvassd
* openvas-mkcert
* /etc/openvas/*

 

====334.3 Packet Filtering (weight: 5)====
{|
| style="background:#dadada" | '''Weight'''
| style="background:#eaeaea" | 5
|-
| style="background:#dadada; padding-right:1em" | '''Description'''
| style="background:#eaeaea" | Candidates should be familiar with the use and configuration of the netfilter Linux packet filter.
|}
'''Key Knowledge Areas:'''
* Understand common firewall architectures, including DMZ
* Understand and use iptables and ip6tables, including standard modules, tests and targets
* Implement packet filtering for IPv4 and IPv6
* Implement connection tracking and network address translation
* Manage IP sets and use them in netfilter rules
* Awareness of nftables and nft
* Awareness of ebtables
* Awareness of conntrackd
'''Partial list of the used files, terms and utilities:'''
* iptables
* ip6tables
* iptables-save
* iptables-restore
* ip6tables-save
* ip6tables-restore
* ipset
 

====334.4 Virtual Private Networks (weight: 4)====
{|
| style="background:#dadada" | '''Weight'''
| style="background:#eaeaea" | 4
|-
| style="background:#dadada; padding-right:1em" | '''Description'''
| style="background:#eaeaea" | Candidates should be familiar with the use of OpenVPN, IPsec and WireGuard to set up remote access and site to site VPNs.
|}
'''Key Knowledge Areas:'''
* Understand the principles of bridged and routed VPNs
* Understand the principles and major differences of the OpenVPN, IPsec, IKEv2 and WireGuard protocols
* Configure and operate OpenVPN servers and clients
* Configure and operate IPsec servers and clients using strongSwan
* Configure and operate WireGuard servers and clients
* Awareness of L2TP
'''Partial list of the used files, terms and utilities:'''
* /etc/openvpn/
* openvpn
* /etc/strongswan.conf
* /etc/strongswan.d/
* /etc/swanctl/swanctl.conf
* /etc/swanctl/
* swanctl
* /etc/wireguard/
* wg
* ip

 

===''Topic 335: Threats and Vulnerability Assessment''===

====335.1 Common Security Vulnerabilities and Threats (weight: 2)====
{|
| style="background:#dadada" | '''Weight'''
| style="background:#eaeaea" | 2
|-
| style="background:#dadada; padding-right:1em" | '''Description'''
| style="background:#eaeaea" | Candidates should understand the principle of major types of security vulnerabilities and threats.
|}
'''Key Knowledge Areas:'''
* Conceptual understanding of threats against individual nodes
* Conceptual understanding of threats against networks
* Conceptual understanding of threats against application
* Conceptual understanding of threats against credentials and confidentiality
* Conceptual understanding of honeypots
'''The following is a partial list of the used files, terms and utilities:'''
* Trojans
* Viruses
* Rootkits
* Keylogger
* DoS and DDoS
* Man in the Middle
* ARP and NDP forgery
* Rogue Access Points, Routers and DHCP servers
* Link layer address and IP address spoofing
* Buffer Overflows
* SQL and Code Injections
* Cross Site Scripting
* Cross Site Request Forgery
* Privilege escalation
* Brute Force Attacks
* Rainbow tables
* Phishing
* Social Engineering
 

====335.2 Penetration Testing (weight: 3)====
{|
| style="background:#dadada" | '''Weight'''
| style="background:#eaeaea" | 3
|-
| style="background:#dadada; padding-right:1em" | '''Description'''
| style="background:#eaeaea" | Candidates understand the concepts of penetration testing, including an understand of commonly used penetration testing tools. Furthermore, candidates should be able to use nmap to verify the effectiveness of network security measures.
|}
'''Key Knowledge Areas:'''
* Understand the concepts of penetration testing and ethical hacking
* Understand legal implications of penetration testing
* Understand the phases of penetration tests, such as active and passive information gathering, enumeration, gaining access, privilege escalation, access maintenance, covering tracks
* Understand the architecture and components of Metasploit, including Metasploit module types and how Metasploit integrates various security tools
* Use nmap to scan networks and hosts, including different scan methods, version scans and operating system recognition
* Understand the concepts of Nmap Scripting Engine and execute existing scripts
* Awareness of Kali Linux, Armitage and the Social Engineer Toolkit (SET)
'''Partial list of the used files, terms and utilities:'''
* nmap