LPIC-3 Examen 303 Seguridad

## 325.1 X.509 Certificates and Public Key Infrastructures

* Understand X.509 certificates, X.509 certificate lifecycle, X.509 certificate fields and X.509v3 certificate extensions
* Understand trust chains and public key infrastructures
* Generate and manage public and private keys
* Create, operate and secure a certification authority
* Request, sign and manage server and client certificates
* Revoke certificates and certification authorities

```
openssl, including relevant subcommands

```

```
OpenSSL configuration

```

```
PEM, DER, PKCS

```

```
CSR

```

```
CRL

```

```
OCSP

```

## 325.2 X.509 Certificates for Encryption, Signing and Authentication

* Understand SSL, TLS and protocol versions
* Understand common transport layer security threats, for example Man-in-the-Middle
* Configure Apache HTTPD with mod\_ssl to provide HTTPS service, including SNI and HSTS
* Configure Apache HTTPD with mod\_ssl to authenticate users using certificates
* Configure Apache HTTPD with mod\_ssl to provide OCSP stapling
* Use OpenSSL for SSL/TLS client and server tests

```
Intermediate certification authorities

```

```
Cipher configuration (no cipher-specific knowledge)

```

```
httpd.conf

```

```
mod_ssl

```

```
openssl

```

## 325.3 Encrypted File Systems

* Understand block device and file system encryption
* Use dm-crypt with LUKS to encrypt block devices
* Use eCryptfs to encrypt file systems, including home directories and
* PAM integration
* Be aware of plain dm-crypt and EncFS

```
cryptsetup

```

```
cryptmount

```

```
/etc/crypttab

```

```
ecryptfsd

```

```
ecryptfs-* commands

```

```
mount.ecryptfs, umount.ecryptfs

```

```
pam_ecryptfs

```

## 325.4 DNS and Cryptography

* Understanding of DNSSEC and DANE
* Configure and troubleshoot BIND as an authoritative name server serving DNSSEC secured zones
* Configure BIND as an recursive name server that performs DNSSEC validation on behalf of its clients
* Key Signing Key, Zone Signing Key, Key Tag
* Key generation, key storage, key management and key rollover
* Maintenance and re-signing of zones

* Use DANE to publish X.509 certificate information in DNS
* Use TSIG for secure communication with BIND

```
DNS, EDNS, Zones, Resource Records

```

```
DNS resource records: DS, DNSKEY, RRSIG, NSEC, NSEC3, NSEC3PARAM, TLSA

```

```
DO-Bit, AD-Bit

```

```
TSIG

```

```
named.conf

```

```
dnssec-keygen

```

```
dnssec-signzone

```

```
dnssec-settime

```

```
dnssec-dsfromkey

```

```
rndc

```

```
dig

```

```
delv

```

```
openssl

```

## 326.1 Host Hardening

* Configure BIOS and boot loader (GRUB 2) security
* Disable useless software and services
* Use sysctl for security related kernel configuration, particularly ASLR, Exec-Shield and IP / ICMP configuration
* Exec-Shield and IP / ICMP configuration
* Limit resource usage
* Work with chroot environments
* Drop unnecessary capabilities
* Be aware of the security advantages of virtualization

```
grub.cfg

```

```
chkconfig, systemctl

```

```
ulimit

```

```
/etc/security/limits.conf

```

```
pam_limits.so

```

```
chroot

```

```
sysctl

```

```
/etc/sysctl.conf

```

## 326.2 Host Intrusion Detection

* Use and configure the Linux Audit system
* Use chkrootkit
* Use and configure rkhunter, including updates
* Use Linux Malware Detect
* Automate host scans using cron
* Configure and use AIDE, including rule management
* Be aware of OpenSCAP

```
auditd

```

```
auditctl

```

```
ausearch, aureport

```

```
auditd.conf

```

```
auditd.rules

```

```
pam_tty_audit.so

```

```
chkrootkit

```

```
rkhunter

```

```
/etc/rkhunter.conf

```

```
maldet

```

```
conf.maldet

```

```
aide

```

```
/etc/aide/aide.conf

```