LPIC-3 303: Security — Deep Dive Study Guide

LPI DevOps Tools Engineer Certification Guide

Complete guide to the LPI DevOps Tools Engineer certification (701-100): exam objectives, study resources, and how it relates to traditional LPI certifications.

LPIC-1 102-500 Deep Dive: Shell Scripting, User Management, Networking, and Security

Master LPIC-1 102-500: shell scripting, user management, networking fundamentals, system security, and administrative tasks with detailed command examples.

The LPIC-3 303: Security exam covers cryptography, public key infrastructure, file and network security, PAM, SSH hardening, access control systems (SELinux/AppArmor), and system auditing. This guide provides a command-level deep dive into each objective.

Cryptography Concepts

Symmetric vs Asymmetric Encryption

OpenSSL Command Reference

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:4096 -out private.key

# Generate an ECDSA key (NIST P-256)
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:prime256v1 -out ecdsa.key

# Generate a self-signed certificate
openssl req -x509 -new -nodes -key private.key -sha256 -days 365 \
  -subj "/C=DE/ST=Berlin/L=Berlin/O=Example/CN=server.example.com" \
  -out cert.pem

# View certificate details
openssl x509 -in cert.pem -text -noout

# Generate a CSR
openssl req -new -key private.key -out request.csr \
  -subj "/CN=server.example.com"

# Encrypt a file with AES-256
openssl enc -aes-256-cbc -salt -in plain.txt -out encrypted.enc

# Decrypt a file
openssl enc -d -aes-256-cbc -in encrypted.enc -out plain.txt

Public Key Infrastructure (PKI)

Certificate Authority Setup

# Create the CA directory structure
mkdir -p ca/{certs,crl,newcerts,private,requests}
chmod 700 ca/private
echo 1000 > ca/serial
touch ca/index.txt

# Configure openssl-ca.cnf
[ ca ]
default_ca = CA_default

[ CA_default ]
database = ca/index.txt
serial = ca/serial
private_key = ca/private/ca.key.pem
certificate = ca/certs/ca.cert.pem
default_days = 365
default_md = sha256
policy = policy_strict

[ policy_strict ]
countryName = match
stateOrProvinceName = match
organizationName = match
organizationalUnitName = optional
commonName = supplied
emailAddress = optional

# Generate CA key and self-signed certificate
openssl genpkey -algorithm RSA -out ca/private/ca.key.pem -pkeyopt rsa_keygen_bits:4096
openssl req -x509 -new -key ca/private/ca.key.pem -out ca/certs/ca.cert.pem \
  -days 3650 -subj "/C=DE/O=Example CA/CN=Example Root CA"

# Sign a server CSR
openssl ca -config openssl-ca.cnf -in server.csr -out server.crt

# Revoke a certificate
openssl ca -config openssl-ca.cnf -revoke server.crt

# Generate CRL
openssl ca -config openssl-ca.cnf -gencrl -out ca/crl/ca.crl.pem

# Verify CRL
openssl crl -in ca/crl/ca.crl.pem -text -noout

Certificate Path Validation

# Verify certificate chain
openssl verify -CAfile ca.cert.pem -untrusted intermediate.cert.pem server.crt

# Check if certificate is revoked (with CRL)
openssl verify -CAfile ca.cert.pem -CRLfile ca.crl.pem server.crt

File Security

POSIX ACLs

# View ACLs
getfacl /path/to/file

# Set ACL: grant user read/write
setfacl -m u:jdoe:rw /path/to/file

# Set ACL: grant group read/execute
setfacl -m g:developers:rx /path/to/dir

# Remove specific ACL entry
setfacl -x u:jdoe /path/to/file

# Set default ACL for directory (inherited by new files)
setfacl -d -m g:developers:rx /path/to/dir

# Recursive ACL application
setfacl -R -m g:developers:rx /path/to/dir

# Backup and restore ACLs
getfacl -R /path > acls.backup
setfacl --restore=acls.backup

Extended Attributes (xattrs)

# Set extended attribute
setfattr -n user.comment -v "Important document" file.txt

# View extended attributes
getfattr -d file.txt

# Remove extended attribute
setfattr -x user.comment file.txt

# List attributes (shows only attribute names)
attr -l file.txt

# Security extended attributes (SELinux context)
getfattr -n security.selinux file.txt

Immutable and Append-Only Flags

# Make a file immutable (even root cannot modify)
chattr +i /etc/hosts

# Append-only mode (log files)
chattr +a /var/log/auth.log

# View flags
lsattr /etc/hosts

# Remove immutable flag
chattr -i /etc/hosts

Network Security

nftables Configuration

# Create a ruleset file: /etc/nftables.conf
table inet filter {
   chain input {
      type filter hook input priority 0; policy drop;
      ct state established,related accept
      ct state invalid drop
      iif "lo" accept
      ip protocol icmp accept
      tcp dport 22 counter accept
      tcp dport 80 counter accept
      tcp dport 443 counter accept
   }
   chain forward {
      type filter hook forward priority 0; policy drop;
   }
   chain output {
      type filter hook output priority 0; policy accept;
   }
}

# Apply ruleset
nft -f /etc/nftables.conf

# List rules
nft list ruleset

# Add temporary rule
nft add rule inet filter input tcp dport 8080 accept

# Delete rule (get handle first)
nft -a list ruleset
nft delete rule inet filter input handle 3

fail2ban Configuration

# /etc/fail2ban/jail.local
[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 5
bantime = 3600
findtime = 600

# Custom filter: /etc/fail2ban/filter.d/nginx-botsearch.conf
[Definition]
failregex = ^<HOST> - -.*GET.*(?:/wp-admin|/admin|/\.env).*HTTP
ignoreregex =

# Manage jails
fail2ban-client status
fail2ban-client status sshd
fail2ban-client set sshd unbanip 10.0.0.5

PAM (Pluggable Authentication Modules)

PAM Module Types

PAM Configuration Format

# /etc/pam.d/common-auth
auth    [success=2 default=ignore]  pam_unix.so    nullok_secure
auth    [success=1 default=ignore]  pam_ldap.so    use_first_pass
auth    requisite                   pam_deny.so
auth    required                    pam_permit.so

# /etc/pam.d/common-password
password  requisite  pam_pwquality.so  retry=3 minlen=12
password  [success=1 default=ignore]  pam_unix.so  obscure use_authtok sha512
password  requisite                   pam_deny.so
password  required                    pam_permit.so

# /etc/pam.d/common-session
session  required  pam_env.so
session  required  pam_unix.so
session  optional  pam_ldap.so
session  optional  pam_systemd.so

Control Flags

PAM Example: Google Authenticator 2FA

# Install
apt-get install libpam-google-authenticator

# Configure user
google-authenticator

# /etc/pam.d/sshd
auth  required  pam_google_authenticator.so
auth  required  pam_unix.so

# /etc/ssh/sshd_config
ChallengeResponseAuthentication yes
AuthenticationMethods publickey,keyboard-interactive

SSH Hardening

Server Configuration (/etc/ssh/sshd_config)

# Cryptographic
HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_rsa_key
KexAlgorithms sntrup761x25519-sha512@openssh.com,diffie-hellman-group16-sha512
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com

# Authentication
PubkeyAuthentication yes
PasswordAuthentication no
ChallengeResponseAuthentication no
AuthenticationMethods publickey
PermitRootLogin prohibit-password
MaxAuthTries 3
LoginGraceTime 30

# Session
ClientAliveInterval 300
ClientAliveCountMax 2
MaxSessions 10
AllowUsers jdoe admin

# Forwarding
X11Forwarding no
AllowTcpForwarding no
AllowAgentForwarding no

SSH Key Management

# Generate Ed25519 key (recommended)
ssh-keygen -t ed25519 -a 100 -f ~/.ssh/id_ed25519

# Generate RSA key (for legacy systems)
ssh-keygen -t rsa -b 4096 -a 100 -f ~/.ssh/id_rsa

# Copy public key to host
ssh-copy-id -i ~/.ssh/id_ed25519.pub user@host

# Use SSH agent for key forwarding
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519
ssh -A user@host

# SSH tunnel (local port forwarding)
ssh -L 8080:internal-web:80 user@bastion

# SSH tunnel (remote port forwarding)
ssh -R 9090:localhost:3000 user@public-host

Mandatory Access Control: SELinux

SELinux Modes

# Check current mode
getenforce

# Check mode and policy
sestatus

# Change mode temporarily
setenforce 0   # Permissive
setenforce 1   # Enforcing

# Change mode permanently
# /etc/selinux/config
SELINUX=enforcing
SELINUXTYPE=targeted

SELinux Contexts

# View file context
ls -Z /var/www/html/index.html

# View process context
ps -eZ | grep httpd

# Change file context
chcon -t httpd_sys_content_t /var/www/html/index.html

# Restore default context
restorecon -Rv /var/www/html/

# Apply contexts based on policy spec
setfiles /etc/selinux/targeted/contexts/files/file_contexts /var/www

# Set file context persistently (for relabeling)
semanage fcontext -a -t httpd_sys_content_t "/web(/.*)?"
restorecon -Rv /web

SELinux Booleans

# List booleans
getsebool -a

# Check specific boolean
getsebool httpd_can_network_connect

# Set boolean (temporary)
setsebool httpd_can_network_connect on

# Set boolean (permanent)
setsebool -P httpd_can_network_connect on

SELinux Audit Analysis

# View denials
grep AVC /var/log/audit/audit.log

# Analyze with sealert
sealert -a /var/log/audit/audit.log

# Create policy module for a custom application
audit2allow -a -M myapp
semodule -i myapp.pp

AppArmor (Alternative to SELinux)

# Check AppArmor status
apparmor_status

# Set profile mode
aa-enforce /path/to/profile  # Enforcing
aa-complain /path/to/profile # Log-only

# Generate profile for a binary
aa-genprof /usr/bin/myapp

# Update profile based on logs
aa-logprof

# Custom profile: /etc/apparmor.d/usr.bin.myapp
#include <tunables/global>

/usr/bin/myapp {
   #include <abstractions/base>

   /etc/myapp/config r,
   /var/lib/myapp/** rw,
   /tmp/myapp-* rw,
   network inet tcp,
}

System Auditing with auditd

# Install and start
apt-get install auditd audispd-plugins

# Add audit rule
auditctl -w /etc/passwd -p wa -k passwd_changes
auditctl -w /etc/shadow -p wa -k shadow_changes
auditctl -a exit,always -S execve -F uid!>=1000 -k user_commands

# List rules
auditctl -l

# Search audit log
ausearch -k passwd_changes
ausearch -ts today -k user_commands

# Generate report
aureport -l  # Login report
aureport -x  # Command execution report
aureport -k  # Keyed event report

# Make rules persistent
# /etc/audit/rules.d/audit.rules

Test Your Knowledge with Practice Exams

Ready to put this knowledge to the test? The interactive LPI practice platform on courses.graphwiz.ai includes 400+ realistic questions covering LPIC-1, LPIC-2, LPIC-3, and DevOps Tools Engineer certifications — with study mode, timed exams, domain breakdowns, weak-area analysis, and spaced-repetition flashcards.

Start Practicing on courses.graphwiz.ai →

Related Articles

• LPIC-3 Certification Guide — "LPIC-3 Certification Guide"
• LPIC-3 300: Mixed Environment — Deep Dive Study Guide — "LPIC-3 300 Mixed Environment Deep Dive"
• LPIC-3 304: Virtualization & HA — Deep Dive Study Guide — "LPIC-3 304 Virtualization & HA Deep Dive"
• Is LPIC Worth It in 2026? — Salary impact, employer demand, and certification ROI
• LPIC vs RHCSA vs CompTIA Linux+ — Which certification path is right for you?
• Browse All LPI Resources — Full library of study guides, deep dives, and practice questions