LCA System Security & Firewall Management — Questions and Answers

Question 1: Which command is used to check the status of the firewall on a Linux system?

iptables --status
firewalld-cmd --state (Correct answer)
systemctl firewall status
ufw status

Correct answer: firewalld-cmd --state

For systems using `firewalld`, the `firewall-cmd --state` command is used to check if the `firewalld` service is running. It will output "running" if the firewall daemon is active, or indicate if it's not. This is the standard way to quickly ascertain the operational status of `firewalld`.

Question 2: What does the Linux command 'iptables' manage?

User accounts
File permissions
Network traffic filtering (Correct answer)
Service daemons

Correct answer: Network traffic filtering

`iptables` is a command-line utility that allows system administrators to configure the Linux kernel firewall (netfilter). It is used to set up, maintain, and inspect the tables of IP packet filter rules in the Linux kernel. This enables precise control over incoming and outgoing network traffic, enhancing system security.

Question 3: Which tool simplifies firewall management on many Linux distributions?

ufw
firewalld (Correct answer)
tcpdump
fail2ban

Correct answer: firewalld

`firewalld` is a dynamic firewall management tool that simplifies firewall configuration on many Linux distributions, especially Red Hat-based ones like CentOS and Fedora. It uses zones and services to manage rules, allowing for easier and more flexible configuration compared to directly manipulating `iptables` rules. It can change rules without dropping existing connections.

Question 4: What port number does SSH use by default?

21
22 (Correct answer)
80
443

Correct answer: 22

SSH (Secure Shell) uses port 22 by default for secure remote access to Linux systems. This port is standardized for SSH connections, allowing encrypted communication and secure command execution over an unsecured network. While it's common practice to change this default port for added security, 22 remains the standard.

Question 5: What is the primary purpose of Fail2Ban?

Log monitoring
Intrusion prevention (Correct answer)
Firewall configuration
User management

Correct answer: Intrusion prevention

Fail2Ban is an intrusion prevention software framework that protects computer servers from brute-force attacks. It works by monitoring log files for suspicious activity, such as repeated failed login attempts, and then automatically bans the offending IP addresses using firewall rules. This significantly reduces the risk of successful brute-force attacks against services like SSH or web servers.

Question 6: Which file contains firewall rules in iptables?

/etc/firewall/rules
/etc/iptables.rules
/etc/sysconfig/iptables (Correct answer)
/etc/firewalld.conf

Correct answer: /etc/sysconfig/iptables

On systems that use `iptables` directly (often older systems or those not using `firewalld`), the persistent firewall rules are typically stored in `/etc/sysconfig/iptables` (and `/etc/sysconfig/ip6tables` for IPv6). This file is loaded at boot time to restore the firewall configuration. It's important to save rules to this file after making changes to ensure they persist across reboots.

Question 7: What command reloads firewall rules in firewalld?

service firewalld restart
firewall-cmd --reload (Correct answer)
iptables-restart
systemctl restart firewall

Correct answer: firewall-cmd --reload

The `firewall-cmd --reload` command is used to reload the `firewalld` configuration without interrupting existing connections. This is a key feature of `firewalld`'s dynamic nature, allowing administrators to apply new rules or changes to zones and services efficiently and without service disruption. It applies the changes from the configuration files.

Question 8: Which of the following ports should be closed to reduce attack surface on a server?

Unused services ports (Correct answer)
Port 80
Port 22
Port 443

Correct answer: Unused services ports

To reduce the attack surface on a server, it is crucial to close ports associated with unused services. Each open port represents a potential entry point for attackers, as it could be exploited if the service running on it has vulnerabilities. By closing unnecessary ports, you limit the ways an attacker can interact with your system, thereby enhancing security.

Question 9: Which Linux security module provides Mandatory Access Control?

AppArmor
SELinux (Correct answer)
iptables
firewalld

Correct answer: SELinux

SELinux (Security-Enhanced Linux) is a Linux security module that provides Mandatory Access Control (MAC) capabilities. Unlike traditional Discretionary Access Control (DAC), SELinux enforces policies that restrict what processes and users can do, regardless of standard file permissions. This provides a robust layer of security by limiting the damage even if a service is compromised.

LCA System Security & Firewall Management

Which command is used to check the status of the firewall on a Linux system?