LPIC-2 Certification Guide: Advanced Linux Administration
🇩🇪 Auf Deutsch lesen~12 min read
LPIlpic-2linuxcertificationadvanced-administration
Back openDesk Edu for a sovereign, open-source education — every vote counts.
Vote nowSave products you love by clicking the heart icon.
Complete guide to the LPI DevOps Tools Engineer certification (701-100): exam objectives, study resources, and how it relates to traditional LPI certifications.
Master LPIC-2 201-450: system startup, kernel management, storage, filesystems, advanced networking, and system maintenance with detailed command examples.
LPIC-2 is the second level of the Linux Professional Institute certification program. It validates advanced system administration skills — the ability to plan, implement, and maintain a Linux network infrastructure.
You must hold a current LPIC-1 certification before taking the LPIC-2 exams.
| Exam | Code | Duration | Questions | Passing Score |
|---|---|---|---|---|
| Linux System Administrator 1 | 201-450 | 90 minutes | 60 | 500 / 800 |
| Linux System Administrator 2 | 202-450 | 90 minutes | 60 | 500 / 800 |
Managing system resources and planning for growth:
vmstat — Virtual memory statistics: r (running processes), b (blocked), swpd, cache, si/so (swap in/out), bi/bo (block I/O).iostat — CPU and I/O statistics per device. iostat -x 2 for extended stats every 2 seconds.sar — Historical performance data collection. Requires sysstat package. Data in /var/log/sysstat/.netstat / ss — Network connection statistics. ss -tuln for listening ports, ss -s for summary.mpstat -P ALL — Per-CPU usage breakdown.pidstat — Per-process resource usage.Managing the kernel at runtime and compilation:
uname -r — Current kernel version. uname -a for full details./proc/sys/ — Runtime kernel parameters. Persistent changes go in /etc/sysctl.conf or /etc/sysctl.d/.sysctl -a — List all kernel parameters. sysctl -w net.ipv4.ip_forward=1 sets temporarily.lsmod, modprobe, modinfo, insmod, rmmod. Module config in /etc/modprobe.d/.depmod — Generate modules.dep and map files for module dependency resolution.dmesg — Kernel ring buffer messages. dmesg -w for real-time tail.make menuconfig, make -j$(nproc), make modules_install, make install./boot/ — Contains vmlinuz-*, initrd.img-*, System.map-*, GRUB config.udevadm — udev management tool. udevadm info --query=all --name=/dev/sda, udevadm monitor.Boot process management and recovery:
systemd-analyze — Boot performance. systemd-analyze blame for per-service timing.systemd-analyze critical-chain — Shows the boot dependency chain and which service is slowest.journalctl -b — View logs from current boot. journalctl -b -1 for previous boot./etc/default/grub, then update-grub or grub-mkconfig -o /boot/grub/grub.cfg.initramfs: Temporary root filesystem loaded before the real root. Rebuild with update-initramfs -u.rescue.target (single-user), emergency.target (minimal shell), multi-user.target, graphical.target.systemctl mask <service> — Prevent a service from starting under any condition.reboot --force / systemctl reboot --force — Force reboot without clean shutdown.RAID, LVM, and advanced filesystem management:
mdadm: mdadm --create /dev/md0 --level=5 --raid-devices=4 /dev/sd[b-e].mdadm --detail /dev/md0 — Check RAID status. --fail, --remove, --add for disk replacement./proc/mdstat — Real-time RAID status and rebuild progress.pvcreate → vgcreate → lvcreate. Extend with lvextend -L +5G /dev/vg_name/lv_name.lvresize / lvreduce — Resize logical volumes (filesystem must be resized separately).pvmove — Move physical extents between PVs for storage migration.lvcreate -s -L 1G -n snap /dev/vg/origin — copy-on-write, ideal for backups.resize2fs / xfs_growfs — Grow filesystem to fill resized logical volume.fsck — Filesystem check. Never run on mounted filesystems (except read-only for some types).tune2fs -l /dev/sda1 — List ext2/3/4 superblock information.iSCSI, SAN, and NAS:
iscsiadm -m discovery -t sendtargets -p 192.168.1.100, then iscsiadm -m node --login.targetcli on the server side creates backstores (fileio, block, ramdisk) and LUNs./etc/iscsi/iscsid.conf.multipath -ll — List active multipath devices. Requires device-mapper-multipath package./etc/multipath.conf — Multipath configuration with aliases, blacklists, and failover policies.Advanced networking:
ip addr / ip link / ip route — Modern networking commands (replacing ifconfig)./etc/network/interfaces or nmcli to create a bond of two+ interfaces.
balance-rr (round-robin), active-backup (failover), 802.3ad (LACP), balance-tlb.brctl addbr br0, brctl addif br0 eth0 (or ip link set dev eth0 master br0).ip link add link eth0 name eth0.100 type vlan id 100.ip rule and multiple routing tables in /etc/iproute2/rt_tables.ss -tuln — Replacement for netstat -tuln. Shows all listening TCP/UDP ports.tcpdump -i eth0 port 80 — Packet capture. -n for no DNS resolution, -w file to save.nmcli — NetworkManager command line. nmcli con show, nmcli dev status.ip -6 addr, ip -6 route.Backup and recovery:
tar, rsync, dd, dump/restore, s3cmd, duplicity.rsync -avz /source/ user@host:/dest/ — Incremental remote sync. --delete removes destination files not in source.dd if=/dev/sda of=/backup/mbr.img bs=512 count=1 — Backup MBR (first 512 bytes).du -sh /var / df -h — Disk usage and free space monitoring.BIND configuration, zones, and troubleshooting:
/etc/named.conf (or /etc/bind/named.conf). Zone files in /var/named/.master (primary), slave (secondary, replicates from master), forward (forwards queries).dig example.com A / dig -x 192.0.2.1 (PTR lookup). dig +trace example.com follows delegation chain.nslookup / host — Simpler DNS lookup tools.rndc reload — Reload BIND configuration without restart. rndc status for server state.dnssec-keygen, dnssec-signzone, DS records, trust anchors./etc/resolv.conf — Client-side resolver configuration. search, nameserver, options rotate.nscd / systemd-resolved — DNS caching services.Apache and Nginx:
<VirtualHost>), modules (a2enmod/a2dismod on Debian), .htaccess.
prefork, worker, event. Check with apachectl -V | grep MPM.SSLEngine on, SSLCertificateFile, SSLCertificateKeyFile.location blocks, reverse proxy with proxy_pass.
nginx -t — Test configuration before reloading. nginx -s reload for graceful reload.ssl_certificate, ssl_certificate_key, ssl_protocols, ssl_ciphers.ProxyPass / Nginx proxy_pass forwards requests to backend servers.certbot, OpenSSL commands for CSR generation and key management.KeepAlive, caching, gzip compression, worker processes/connections.Samba and NFS:
/etc/samba/smb.conf. Global settings in [global], shares in [sharename].
smbpasswd -a user — Add Samba user. pdbedit -L to list users.security = user / ads / domain — Authentication modes.testparm — Validate smb.conf before restarting.smbstatus — Active connections and locked files./etc/exports defines exported directories. exportfs -r to reload.
mount -t nfs4 server:/export /mnt. Uses rpc.idmapd for UID/GID mapping.showmount -e server — List NFS exports on a server.rpcinfo -p server — List RPC services (portmapper, nfs, mountd, nlockmgr)./etc/auto.master and map files.DHCP and PAM:
/etc/dhcp/dhcpd.conf. Define subnet, range, options (routers, DNS).
dhcpd -t — Test configuration. dhcpd -f for foreground/debug mode.dhcrelay) forwards DHCP requests across subnets./etc/pam.d/ controls authentication for each service.
auth, account, session, password.requisite, required, sufficient, optional.pam_unix.so, pam_ldap.so, pam_krb5.so, pam_limits.so.pam_tally2 / pam_faillock — Account lockout after failed attempts.Postfix configuration and mail handling:
/etc/postfix/main.cf. Key parameters: myhostname, mydomain, myorigin, mydestination.
postfix check — Verify configuration. postfix reload for safe reload.mailq — View mail queue. postsuper -d ALL to delete all queued messages.mynetworks (trusted clients), relayhost (smart host).SpamAssassin with amavisd-new, or rspamd.opendkim-genkey → DNS TXT record → opendkim filter in Postfix.mailx/mutt for local mail reading.Firewalls, VPNs, SSH, and auditing:
nft add rule inet filter input tcp dport 22 accept.
nft list ruleset shows all rules. Configuration in /etc/nftables.conf.iptables -A INPUT -p tcp --dport 22 -j ACCEPT.
iptables-save / iptables-restore for persistence. iptables -L -n -v to list rules.firewall-cmd --zone=public --add-service=http --permanent.server.conf/client.conf.
openvpn --genkey --secret static.key for static key. PKI with EasyRSA for full CA.strongSwan or libreswan: IKEv1/IKEv2, certificates, PSK.PermitRootLogin no, PasswordAuthentication no, PubkeyAuthentication yes.
ssh-keygen -t ed25519.sshd -T — Test current SSH server configuration.fail2ban: Ban IPs after repeated failures. Jails for SSH, Apache, Postfix.auditd with audit rules in /etc/audit/audit.rules.
ausearch / aureport — Search and report on audit logs.chkrootkit / rkhunter — Rootkit detection.aide — File integrity monitoring. Initialize: aide --init, compare: aide --check.openssl: openssl s_client -connect host:443 for TLS testing.
openssl req -new -newkey rsa:2048 -keyout key.pem -out csr.pem — Generate CSR.| Week | Focus | Topics | Time |
|---|---|---|---|
| 1 | Kernel + Startup + Capacity | 200, 201, 202 | 10 hours |
| 2 | Storage (RAID, LVM, iSCSI) | 203, 204 | 10 hours |
| 3 | Networking + Maintenance | 205, 206 | 8 hours |
| 4 | DNS + HTTP | 207, 208 | 10 hours |
| 5 | File Sharing + DHCP + PAM + Mail | 209, 210, 211 | 10 hours |
| 6 | Security + Full Review | 212 + all topics | 12 hours |
LPIC-2 requires hands-on practice. Set up:
Before attempting LPIC-2, you should have solid LPIC-1 knowledge, including:
Ready to put this knowledge to the test? The interactive LPI practice platform on courses.graphwiz.ai includes 400+ realistic questions covering LPIC-1, LPIC-2, LPIC-3, and DevOps Tools Engineer certifications — with study mode, timed exams, domain breakdowns, weak-area analysis, and spaced-repetition flashcards.
Start Practicing on courses.graphwiz.ai →