LPIC-2 Certified Linux Engineer Changed 202-450 Questions

The command that creates a SSH key pair is ssh-keygen. This command generates a public and a private key file that can be used for SSH authentication. The command can take various options to specify the algorithm, the file name, the passphrase, and other parameters for the key pair. For more information, see the web search results below or the man page of ssh-keygen.

How to Use ssh-keygen to Generate a New SSH Key?

The netfilter table that contains built-in chains called INPUT, OUTPUT and FORWARD is the filter table. The filter table is the default table for netfilter and iptables, and it is used to filter packets based on their source, destination, protocol, port, state, etc. The filter table has three built-in chains, which correspond to the netfilter hooks that trigger them:

• INPUT: This chain is used to process incoming packets that are destined for the local system. The packets must have passed through the PREROUTING chain and the routing decision before reaching this chain.
• OUTPUT: This chain is used to process outgoing packets that are originated from the local system. The packets must have passed through the routing decision before reaching this chain.
• FORWARD: This chain is used to process packets that are neither originated from nor destined for the local system, but are routed through the system. The packets must have passed through the PREROUTING and POSTROUTING chains and the routing decision before reaching this chain.

The filter table can have user-defined chains as well, which can be created with the -N option of the iptables command. User-defined chains can be used to organize rules and simplify the management of the firewall. Rules can be added to any chain in the filter table with the -A option of the iptables command, and they can specify the target action to take if the packet matches the rule. The target can be one of the following:

• ACCEPT: This target allows the packet to pass through the chain and continue to the next netfilter hook.
• DROP: This target drops the packet and stops its processing.
• REJECT: This target drops the packet and sends back an error message to the sender.
• LOG: This target logs the packet information to the kernel log and continues to the next rule in the chain.
• RETURN: This target returns from the current chain to the calling chain, or to the default policy if there is no calling chain.
• A user-defined chain name: This target jumps to the user-defined chain and executes its rules until a terminal target (ACCEPT, DROP, REJECT, or RETURN) is reached or the end of the chain is reached.

References:

• A Deep Dive into Iptables and Netfilter Architecture
• Iptables Tutorial 1.2.2
• How To List and Delete Iptables Firewall Rules

When the rootdn and rootpw directives are not present in the slapd.conf file, the LDAP administrator account is defined in the file /etc/ldap.secret. This file contains the password for the LDAP root user, which is usually cn=admin,dc=example,dc=com. The file should be owned by root and have permissions of 600 to prevent unauthorized access. The file is referenced by the olcRootPW directive in the cn=config database, which is used to configure the LDAP server. The olcRootPW directive can also be set by using the ldappasswd command with the -Y EXTERNAL option, which allows the LDAP server to authenticate itself to itself using the SASL EXTERNAL mechanism12.

References:

• How To Configure OpenLDAP and Perform Administrative LDAP Tasks | DigitalOcean: A tutorial from DigitalOcean on how to configure OpenLDAP and perform administrative LDAP tasks, which includes the use of the /etc/ldap.secret file and the ldappasswd command.
• OpenLDAP Software 2.6 Administrator’s Guide: Configuring slapd: The official documentation of OpenLDAP on how to configure the slapd daemon, which includes the description of the olcRootPW directive and the SASL EXTERNAL mechanism.

 The Apache HTTPD directive that enables HTTPS protocol support is SSLEngine on. This directive activates the SSL/TLS protocol engine for the current virtual host. HTTPS is a secure version of HTTP that uses SSL/TLS to encrypt the communication between the client and the server. To enable HTTPS, the server must have a valid SSL certificate and a corresponding private key, and configure them using the SSLCertificateFile and SSLCertificateKeyFile directives123 References:

• LPIC-2 Overview
• LPIC-2 202-450
• SSL/TLS Strong Encryption: How-To - Apache HTTP Server Version 2.4