Exam 303: Detailed Objectives

The successful completion of this exam entitles candidates to the specialty designation: LPI 303: Security

Cryptography

OpenSSL

  • Weight: 4
  • Description: Candidates should know how to configure and use OpenSSL. This includes creating your own Certificate Authority and issues SSL certificates for various applications.

Key Knowledge Areas

  • certificate generation
  • key generation
  • SSL/TLS client and server tests

Terms and Utilities

  • openssl
  • RSA, DH and DSA
  • SSL
  • X.509
  • CSR
  • CRL

Advanced GPG

  • Weight: 4
  • Description: Candidates should know how to use GPG. This includes key generation, signing and publishing to keyservers. Managing multiple private key and IDs is also included.

Key Knowledge Areas

  • GPG encyption and signing
  • private/public key management
  • GPG key servers
  • GPG configuration

Terms and Utilities

  • gpg
  • gpgv
  • gpg-agent
  • ~/.gnupg/

Encrypted Filesystems

  • Weight: 3
  • Description: Candidates should be able to setup and configure encrypted filesystems.

Key Knowledge Areas

  • LUKS
  • dm-crypt and awareness of CBC, ESSIV, LRW and XTS modes

Terms and Utilities

  • dm-crypt
  • cryptmount
  • cryptsetup

Access Control

Host Based Access Control

  • Weight: 2
  • Description: Candidates should be familiar with basic host based access control such as nsswitch configuration, PAM and password cracking.

Key Knowledge Areas

  • PAM and PAM configuration files
  • password cracking
  • nsswitch

Terms and Utilities

  • nsswitch.conf
  • john

Extended Attributes and ACLs

  • Weight: 5
  • Description: Candidates are required to understand and know how to use Extended Attributes and Access Control Lists.

Key Knowledge Areas

  • ACLs
  • EAs and attribute classes

Terms and Utilities

  • getfacl
  • setfacl
  • getfattr
  • setfattr

SELinux

  • Weight: 6
  • Description: Candidates should have a thorough knowledge of SELinux.

Key Knowledge Areas

  • SELinux configuration and command line tools
  • TE, RBAC, MAC and DAC concepts and use

Terms and Utilities

  • fixfiles/setfiles
  • newrole
  • setenforce/getenforce
  • selinuxenabled
  • semanage
  • sestatus
  • /etc/selinux/
  • /etc/selinux.d/

Other Mandatory Access Control Systems

  • Weight: 2
  • Description: Candidates should be familiar with other Mandatory Access Control systems for Linux. This includes major features of these systems but not configuration and use.

Key Knowledge Areas

  • SMACK
  • AppArmor

Terms and Utilities

  • SMACK
  • AppArmor

Application Security

BIND/DNS

  • Weight: 2
  • Description: Candidates should have experience and knowledge of security issues in use and configuration of BIND DNS services.

Key Knowledge Areas

  • BIND vulnerabilities
  • chroot environments

Terms and Utilities

  • TSIG
  • BIND ACLs
  • named-checkconf

Mail Services

  • Weight: 2
  • Description: Candidates should have experience and knowledge of security issues in use and configuration of Postfix mail services. Awareness of security issues in Sendmail is also required but not configuration.

Key Knowledge Areas

  • Postfix security centric configuration
  • securing Sendmail
  • chroot environments

Terms and Utilities

  • /etc/postfix/
  • TLS

Apache/HTTP/HTTPS

  • Weight: 2
  • Description: Candidates should have experience and knowledge of security issues in use and configuration of Apache web services.

Key Knowledge Areas

  • Apache v1 and v2 security centric configuration

Terms and Utilities

  • SSL
  • .htaccess
  • Basic Authentication
  • htpasswd
  • AllowOverride

FTP

  • Weight: 1
  • Description: Candidates should have experience and knowledge of security issues in use and configuration of Pure-FTPd and vsftpd FTP services.

Key Knowledge Areas

  • Pure-FTPd configuration and important command line options
  • vsftpd configuration
  • chroot environments

Terms and Utilities

  • SSL/TLS
  • vsftp.conf

OpenSSH

  • Weight: 3
  • Description: Candidates should have experience and knowledge of security issues in use and configuration of OpenSSH SSH services.

Key Knowledge Areas

  • OpenSSH configuration and command line tools
  • OpenSSH key management and access control
  • Awareness of SSH protocol v1 and v2 security issues

Terms and Utilities

  • /etc/ssh/
  • ~/.ssh/
  • ssh-keygen
  • ssh-agent
  • ssh-vulnkey

NFSv4

  • Weight: 1
  • Description: Candidates should have experience and knowledge of security issues in use and configuration of NFSv4 NFS services. Earlier versions of NFS are not required knowledge.

Key Knowledge Areas

  • NFSv4 security improvements, issues and use
  • NFSv4 pseudo file system
  • NFSv4 security mechanisms (LIPKEY, SPKM, Kerberos)

Terms and Utilities

  • NFSv4 ACLs
  • nfs4acl
  • RPCSEC_GSS
  • /etc/exports

Syslog

  • Weight: 1
  • Description: Candidates should have experience and knowledge of security issues in use and configuration of syslog services.

Key Knowledge Areas

  • syslog security issues
  • chroot environments

Terms and Utilities

  • remote syslog servers

Operations Security

Host Configuration Management

  • Weight: 2
  • Description: Candidates should be familiar with the use of RCS and Puppet for host configuration management.

Key Knowledge Areas

  • RCS
  • Puppet

Terms and Utilities

  • RCS
  • ci/co
  • rcsdiff
  • puppet
  • puppetd
  • puppetmasterd
  • /etc/puppet/

Network Security

Intrusion Detection

  • Weight: 4
  • Description: Candidates should be familiar with the use and configuration of intrusion detection software.

Key Knowledge Areas

  • Snort configuration, rules and use
  • Tripwire configuration, policies and use

Terms and Utilities

  • snort
  • snort-stat
  • /etc/snort/
  • tripwire
  • twadmin
  • /etc/tripwire/

Network Security Scanning

  • Weight: 5
  • Description: Candidates should be familiar with the use and configuration of network security scanning tools.

Key Knowledge Areas

  • Nessus configuration, NASL and use
  • Wireshark filters and use

Terms and Utilities

  • nmap
  • wireshark
  • tshark
  • tcpdump
  • nessus
  • nessus-adduser/nessus-rmuser
  • nessusd
  • nessus-mkcert
  • /etc/nessus

Network Monitoring

  • Weight: 3
  • Description: Candidates should be familiar with the use and configuration of network monitoring tools.

Key Knowledge Areas

  • Nagios configuration and use
  • ntop

Terms and Utilities

  • ntop
  • nagios
  • nagiostats
  • nagios.cfg and other configuration files

netfilter/iptables

  • Weight: 5
  • Description: Candidates should be familiar with the use and configuration of iptables.

Key Knowledge Areas

  • Iptables packet filtering and network address translation

Terms and Utilities

  • iptables-save/iptables-restore

OpenVPN

  • Weight: 3
  • Description: Candidates should be familiar with the use of OpenVPN.

Key Knowledge Areas

  • OpenVPN configuration and use

Terms and Utilities

  • openvpn server and client