Official Linux LPIC-3 303 course: Security + exam

ATTENTION: If you belong to the LaaS Cert program, the training does not include an exam.

Official Linux LPI course: LPIC-3 Security - exam 303

The LPIC-3 certification is the culmination of the Linux Professional Institute's (LPI) multi-level professional certification program.

Goals

This course covers the topics for preparing for exam 303 , necessary for the Linux LPI LPIC-3 certification.

Contents for certification

To receive the LPIC-3 Enterprise Security certification, you must be LPIC-2 certified and pass exam 303.

LPIC-3 exam 303:

• Topic 331: Cryptography
  
• Topic 332: Access control
  
• Topic 333: Application Security
  
• Topic 334: Security of operations
  
• Topic 335: Safety Net

LPIC-3 Exam 303

Topic 331: Cryptography

331.1 X.509 Certificates and Public Key Infrastructures

Candidates should understand X.509 certificates and public key infrastructures. They should be able to configure and use OpenSSL to implement certificate authorities and issue SSL certificates for a variety of purposes.

Key knowledge areas:

• Understand X.509 certificates, the X.509 certificate lifecycle, X.509 certificate fields, and X.509v3 certificate extensions.
  
• Understand chains of trust and public key infrastructures, including certificate transparency.
  
• Generate and manage public and private keys
  
• Create, operate, and secure a certification authority
  
• Request, sign, and manage server and client certificates
  
• Revoke certificates and certification authorities
  
• Knowledge of the basic functions of Let's Encrypt, ACME, and certbot
  
• Knowledge of the basic characteristics of CFSSL

331.2 X.509 Certificates for Encryption, Signing, and Authentication

Candidates must be able to use X.509 certificates for both server and client authentication. This includes implementing user and server authentication for Apache HTTPD. The Apache HTTPD version covered is 2.4 or higher.

Key knowledge areas:

• Understand SSL, TLS, including protocol versions and ciphers.
  
• Configure Apache HTTPD with mod_ssl to provide HTTPS service, including SNI and HSTS
  
• Configure Apache HTTPD with mod_ssl to serve certificate chains and configure encryption settings (no specific encryption knowledge required)
  
• Configure Apache HTTPD with mod_ssl to authenticate users using certificates
  
• Configure Apache HTTPD with mod_ssl to provide OCSP stapling
  
• Use OpenSSL for SSL/TLS client and server testing

331.3 Encrypting File Systems

Candidates must be able to install and configure encrypted file systems.

Key knowledge areas:

• Understanding Block Device and File System Encryption
  
• Use dm-crypt with LUKS1 to encrypt block devices
  
• Use eCryptfs to encrypt file systems, including home directories, and PAM integration
  
• Awareness of simple dm-crypt
  
• Knowledge of the features of LUKS2
  
• Conceptual understanding of the hairpin for LUKS devices and hairpin PINs for TMP2 and Network-Bound Disk Encryption (NBDE)/Tang

331.4 DNS and Cryptography

Candidates should have experience and knowledge of cryptography in the context of DNS and its implementation using BIND. The BIND version covered is 9.7 or higher.

Key knowledge areas:

• Understand the concepts of DNS, zones, and resource records.
  
• Understand DNSSEC, including key signing keys, zone signing keys, and relevant DNS records such as DS, DNSKEY, RRSIG, NSEC, NSEC3
  and NSEC3PARAM
• Configure and troubleshoot BIND as an authoritative nameserver serving DNSSEC protected zones
• Manage DNSSEC signed zones, including key generation, key renewal, and zone re-signing
• Configure BIND as a recursive nameserver that performs DNSSEC validation on behalf of its clients
• Understand CAA and DANE, including relevant DNS records such as CAA and TLSA
• Use CAA and DANE to publish X.509 certificate and CA information in DNS
• Use TSIG for secure communication with BIND
• Knowledge of DNS over TLS and DNS over HTTPS
• Understanding Multicast DNS

Topic 332: Host Security

332.1 Host Hardening

Candidates should be able to protect computers running Linux against common threats.

Key knowledge areas:

• Configuring BIOS and Boot Loader Security (GRUB 2)
  
• Disable unused software and services
  
• Understand and remove unnecessary capabilities for specific systemd units and for the entire system
  
• Understand and configure Address Space Layout Randomization (ASLR), Data Execution Prevention (DEP), and Exec-Shield
  
• Whitelist and blacklist USB devices connected to a computer using USBGuard
  
• Create an SSH CA, create SSH certificates for host and user keys using the CA, and configure OpenSSH to use SSH certificates
  
• Working with chroot environments
  
• Use systemd units to limit the system calls and capabilities available to a process
  
• Use systemd units to start processes with limited or no access to specific files and devices
  
• Use systemd units to start processes with dedicated temporary and /dev directories and without network access
  
• Understand the implications of Linux Meltdown and Spectre mitigations and enable/disable mitigations
  
• Polkit awareness
  
• Awareness of the security benefits of virtualization and containerization

332.2 Host Intrusion Detection

Candidates should be familiar with the use and configuration of common host intrusion detection software. This includes managing the Linux audit system and verifying system integrity.

Key knowledge areas:

• Using and configuring the Linux auditing system
  
• Use chkrootkit
  
• Using and configuring rkhunter, including updates
  
• Use Linux Malware Detect
  
• Automate host scans using cron
  
• Use RPM and DPKG package management tools to verify the integrity of installed files.
  
• Configure and use AIDE, including rule management
  
• OpenSCAP Awareness

332.3 Resource control

Candidates should be able to restrict the resources that services and programs can consume.

Key knowledge areas:

• Understanding and configuring ulimits
  
• Understand cgroups, including classes, limits, and accounting.
  
• Manage cgroups and process cgroup association
  
• Understanding systemd slices, scopes, and services
  
• Use systemd units to limit the system resources that processes can consume
  
• Knowledge of the cgmanager and libcgroup utilities

Topic 333: Access control

333.1 Discretionary access control

Candidates should understand discretionary access control (DAC) and know how to implement it using access control lists (ACLs). They should also understand and be able to use extended attributes.

Key knowledge areas:

• Understand and manage file ownership and permissions, including SetUID and SetGID bits
  
• Understanding and managing access control lists
  
• Understanding and managing extended attributes and attribute classes

333.2 Mandatory access control

Candidates should be familiar with mandatory access control (MAC) systems for Linux. Specifically, they should have a thorough understanding of SELinux. They should also be familiar with other mandatory access control systems for Linux. This includes the main features of these systems, but not their configuration or use.

Key knowledge areas:

• Understand the concepts of type enforcement, role-based access control, mandatory access control, and discretionary access control.
  
• Configure, manage, and use SELinux
  
• Knowledge of AppArmor and Smack

Topic 334: Network Security

334.1 Network Strengthening

Candidates must be able to protect networks against common threats. This includes analyzing network traffic from specific nodes and protocols.

Key knowledge areas:

• Understanding the security mechanisms of wireless networks
  
• Configure FreeRADIUS to authenticate network nodes
  
• Use Wireshark and tcpdump to analyze network traffic, including filters and statistics.
  
• Use Kismet to analyze wireless networks and capture wireless network traffic
  
• Identify and address fake router advertisements and DHCP messages
  
• Aircrack-ng and BetterCap Awareness

334.2 Network Intrusion Detection

Candidates should be familiar with the use and configuration of network scanning, monitoring, and intrusion detection software. This includes updating and maintaining security scanners.

Key knowledge areas:

• Implement bandwidth usage monitoring
  
• Configure and use Snort, including rule management
  
• Configure and use OpenVAS, including NASL

334.3 Packet Filtering

Candidates should be familiar with using and configuring the Linux packet filter netfilter.

Key knowledge areas:

• Understand common firewall architectures, including the DMZ
  
• Understand and use iptables and ip6tables, including standard modules, tests, and targets.
  
• Implement packet filtering for IPv4 and IPv6
  
• Implement connection tracking and network address translation
  
• Manage IP pools and use them in NetFilter rules
  
• Awareness of nftables and NFTs
  
• Awareness of debits
  
• Control awareness

334.4 Virtual Private Networks

Candidates should be familiar with using OpenVPN, IPsec, and WireGuard to configure remote access and site-to-site VPNs.

Key knowledge areas:

• Understand the principles of routed and bridged VPNs
  
• Understand the principles and key differences between OpenVPN, IPsec, IKEv2, and WireGuard protocols.
  
• Configure and operate OpenVPN servers and clients
  
• Configure and operate IPsec servers and clients using strongSwan
  
• Configure and operate WireGuard servers and clients
  
• L2TP Awareness

Topic 335: Threats and vulnerability assessment

335.1 Common security vulnerabilities and threats

Candidates should understand the principles of the main types of security vulnerabilities and threats.

Key knowledge areas:

• Conceptual understanding of threats against individual nodes
  
• Conceptual understanding of network threats
  
• Conceptual understanding of application threats
  
• Conceptual understanding of threats to credentials and confidentiality
  
• Conceptual understanding of honeypots

335.2 Penetration Testing

Candidates understand the concepts of penetration testing, including knowledge of commonly used tools. They should also be able to use nmap to verify the effectiveness of network security measures.

Key knowledge areas:

• Understand the concepts of penetration testing and ethical hacking.
  
• Understanding the legal implications of penetration testing
  
• Understand the phases of penetration testing, such as active and passive information gathering, enumeration, gaining access, escalating privileges, maintaining access, and covering up trails.
  
• Understand Metasploit architecture and components, including the types of Metasploit modules and how Metasploit integrates various security tools.
  
• Use nmap to scan networks and hosts, including different scanning methods, version scans, and operating system reconnaissance.
  
• Understand Nmap Scripting Engine concepts and run existing scripts
  
• Knowledge of Kali Linux, Armitage, and the Social Engineering Toolkit (SET)

Language

The e-Learning components on which the training is conducted are in English and Spanish .

Exam languages ​​available at VUE test centers: English, Japanese

Exam languages ​​available online through OnVUE: English, Japanese

Requirements

The candidate must have an active LPIC-2 certification to receive the LPIC-3 certification.