LPI 202-450 - LPIC-2 - Exam 202 (part 2 of 2), version 4.5

The relayhost parameter in the Postfix configuration file (/etc/postfix/main.cf) specifies the hostname or IP address of an external SMTP server that will handle the outgoing emails for Postfix. This server is also known as a smarthost or a relayhost. By using a relayhost, Postfix can delegate the responsibility of delivering emails to remote destinations to another server that may have better network connectivity, security, or reputation. A relayhost can also provide authentication, encryption, or filtering services for Postfix. References:

Postfix Standard Configuration Examples

How to configure Postfix relayhost (smarthost) to send eMail using an external smptd

Samba cannot use /etc/passwd and /etc/shadow directly because they store passwords in a different format than CIFS. CIFS passwords are encrypted using a one-way hash function, while Unix passwords are encrypted using a two-way cipher. Therefore, Samba needs a separate password file that stores the CIFS passwords in a compatible format. This file is usually called smbpasswd and can be created or updated using the smbpasswd command123 References:

Chapter 9. Users and Security - Samba

smbpasswd - Samba

Chapter 20. samba authentication - linux-training.be

Chapter 9. Users and Security - Samba3

Chapter 9. Users and Security - Samba

The cache_dir directive in the Squid configuration file specifies the type, location, size, and structure of the cache directory. The ufs type indicates that Squid uses the UNIX file system to store the cache files. The /var/spool/squid3/ is the path to the cache directory. The 1024 is the size of the cache in megabytes. The 16 and 256 are the number of first-level and second-level subdirectories that Squid creates under the cache directory.

Squid uses hexadecimal numbers to name the subdirectories, from 00 to FF. Therefore, there will be 16 first-level subdirectories, named 00, 01, 02, …, 0E, 0F. Under each first-level subdirectory, there will be 256 second-level subdirectories, named 00, 01, 02, …, FE, FF. For example, the subdirectory /var/spool/squid3/0F/FF will contain the cache files whose hash values end with 0FFF.

Therefore, the correct answer is A. 0F and E. 00, as they are the names of the first-level subdirectories that will exist directly within the directory /var/spool/squid3/. The other options are either invalid or second-level subdirectories that will not exist directly within the directory /var/spool/squid3/.

According to the OpenLDAP Software 2.6 Administrator’s Guide1, the default access control policy is allow read by all clients. This means that if there is no access directive, any client can read any entry or attribute in the directory, but cannot modify or delete them. Therefore, option C is the correct answer, as it represents this policy. Option A is incorrect, as it grants write access to all clients, which is not the default. Option B is incorrect, as it denies access to all clients, which is also not the default. Option D is incorrect, as it grants read and write access only to the rootdn, which is the superuser of the directory, and denies access to all other clients.

References:

OpenLDAP Software 2.6 Administrator’s Guide: Access Control: The official documentation of OpenLDAP on how to configure access control for the directory server.

The sshd configuration file is used to customize the behavior of the SSH server daemon. Some of the lines in the file can affect the security of the server and should be modified accordingly. The following are two examples of such lines:

Protocol 2, 1: This line specifies the SSH protocol versions that are supported by the server. The possible values are 1 and 2, where 1 is the older and less secure version and 2 is the newer and more secure version. The recommended value is 2, as it provides stronger encryption, authentication, and integrity mechanisms. Allowing protocol 1 can expose the server to various attacks, such as man-in-the-middle, replay, and insertion attacks. Therefore, this line should be changed to Protocol 2 or commented out (as protocol 2 is the default value).

PermitRootLogin yes: This line determines whether root login is allowed on the server. The possible values are yes, no, prohibit-password, and without-password. The value yes allows root login with any authentication method, including password. This can pose a serious security risk, as root is the most privileged user on the system and can perform any action. If an attacker manages to guess or obtain the root password, they can gain full control over the server. Therefore, this line should be changed to no or prohibit-password (which allows root login only with public key authentication) or commented out (as no is the default value).

References: LPIC-2 202 exam objectives, LPIC-2 202-450 Exam Prep: Network Configuration, The Best Ways to Secure Your SSH Server, Configure the /etc/ssh/sshd_config file

Linux SSH Server (sshd) Configuration and Security Options With ...1

The Best Ways to Secure Your SSH Server - How-To Geek

The tool dig, which stands for domain information groper, is a command-line utility that provides the most information when performing DNS queries, without any options. Dig can query any type of DNS record and display the full response from the DNS server, including the header, question, answer, authority, and additional sections. Dig can also show the query time, server address, response code, flags, and statistics. Dig is a versatile and powerful tool that can be used for troubleshooting, testing, and debugging DNS issues123 References:

dig(1) - Linux manual page

How to Use the Dig Command on Linux

How to use the dig command for DNS queries on Linux

The verbose_proctitle parameter in the Dovecot configuration file controls whether Dovecot adds extra information to its process titles. When this parameter is set to yes, Dovecot will show the username, IP address of the peer, and the connection status for each process. This can help to associate the processes with users and peers, and to monitor the activity of the mail server. For example, the process titles may look like this:

dovecot/imap-login user@domain.com [192.168.0.1] dovecot/imap user@domain.com [192.168.0.1] IDLE

The verbose_proctitle parameter can be set in the /etc/dovecot/dovecot.conf file or in the /etc/dovecot/conf.d/10-master.conf file. The default value is no, which means that Dovecot will only show the process name and the command state. For example:

dovecot/imap-login dovecot/imap [idling]

The other options are not related to the process titles. The --with-linux-extprocnames option for ./configure when building Dovecot is not a valid option. The sys.ps.allow_descriptions and proc.all.show_status parameters in sysctl.conf or /proc are not valid parameters. The process_format parameter in the Dovecot configuration is used to specify the format of the process name, not the process title.

References:

LPIC-2 Exam 202 Objectives, Objective 205.4: Managing a dovecot server

Process Titles — Dovecot documentation, Dovecot Documentation

Dovecot Configuration Parameters: verbose_proctitle, Dovecot Documentation

Dovecot Configuration Parameters: process_name, Dovecot Documentation

How to monitor dovecot processes? - Server Fault, Forum

 The sender_canonical_maps parameter on a Postfix server specifies an optional address mapping that applies when mail is delivered (sent) from the server. This mapping can be used to rewrite the sender address of outgoing messages to a different format or domain. For example, the following sender_canonical_maps entry will rewrite the sender address from user@localdomain to user@example.com:

user@localdomain user@example.com

The sender_canonical_maps parameter only affects the sender address and not the recipient address. The recipient address can be modified by other parameters such as recipient_canonical_maps or virtual_alias_maps.

References: You can learn more about sender_canonical_maps and other Postfix address rewriting parameters from the following sources:

Postfix Address Rewriting

Postfix Configuration Parameters

Postfix Generic Mapping for Outgoing SMTP Mail

The word missing from the excerpt of a named.conf file is “acl”. This is because the excerpt is defining an access control list (ACL) for the DNS server. The ACL is used to restrict access to the DNS server and is defined in the named.conf file. The syntax for defining an ACL is:

acl name { address_match_list; };

where name is the name of the ACL, and address_match_list is a list of IP addresses, networks, or keywords that match the clients that are allowed or denied access.References:

LPIC-2 Overview

LPIC-2 202-450

BIND 9 Administrator Reference Manual