LPI Updated 102-500 Exam Questions and Answers by travis

The command journalctl is included in systemd and supports selecting messages from the systemd journal by criteria such as time or unit name. The systemd journal is a binary log file that stores system and service messages. The journalctl command can be used to view, filter, export, and manipulate the journal entries. For example, to show all messages from a specific unit, such as sshd.service, the command would be:

journalctl -u sshd.service

To show all messages from a specific time range, such as yesterday, the command would be:

journalctl --since=yesterday

The journalctl command has many options and arguments that can be used to customize the output and perform various operations on the journal. For more information, see the man page of journalctl or the official documentation1. References: [LPI 102-500 Exam Objectives], Topic 106.2: System logging, Weight: 3. [systemd-journald.service(8) — systemd — Debian unstable — Debian Manpages], Section NAME.

 On a Linux system with shadow passwords enabled, the file that contains the password hashes of all local users is /etc/shadow. This file is a replacement for the password field in /etc/passwd, which is a world-readable file that contains basic information about users. The /etc/shadow file is not readable by regular users, and it stores the encrypted passwords (or hashes) of each user, along with other information such as password expiration dates, minimum and maximum password ages, and password warning periods. The /etc/shadow file has nine colon-delimited fields for each user:

Username: The name used when the user logs into the system.

Password: The encrypted password of the user, or a special character that indicates the password status. For example, an asterisk (*) means the account is locked, and an exclamation mark (!) means the password is expired.

Last Password Change: The date of the last password change, expressed as the number of days since January 1, 1970.

Minimum Password Age: The minimum number of days required between password changes. A zero means the password can be changed anytime.

Maximum Password Age: The maximum number of days the password is valid. After this number of days, the password must be changed. A zero means the password never expires.

Password Warning Period: The number of days before the password expires that the user will be warned. A zero means no warning is given.

Password Inactivity Period: The number of days after the password expires that the account will be disabled. A negative value means the account is never disabled.

Account Expiration Date: The date when the account will be disabled, expressed as the number of days since January 1, 1970. A zero means the account never expires.

Reserved Field: A field for future use.

The /etc/shadow file can be modified by using the commands passwd and chage, which are used to change the password and the password aging information of a user, respectively. The /etc/shadow file should not be edited directly, but always through the tools provided by the distribution. For more details, see the shadow manual page.

References:

LPIC-1 Exam 102 Objectives, Topic 110: Security, Subtopic 110.2: Use sudo to manage access to the root account, Weight: 2, Key Knowledge Areas: Configure sudo and sudoers. Use sudo to execute commands as another user.

LPIC-1 Exam 102 Learning Materials, Topic 110: Security, Subtopic 110.2: Use sudo to manage access to the root account, Section 110.2.1: sudo and sudoers, Page 3-5.

 An SSH host key is a cryptographic key used for authenticating computers in the SSH protocol. Host keys are key pairs, typically using the RSA, DSA, or ECDSA algorithms. Public host keys are stored on and/or distributed to SSH clients, and private keys are stored on SSH servers. Each host (i.e., computer) should have a unique host key. Host keys are used for authentication towards the connecting client, analogous to user SSH keys. Host keys are generated using asymmetric encryption algorithms like RSA, DSA, or ECDSA algorithms12. When a client connects to the host, the host sends its public host key to the client, and the client verifies that the host key matches the one stored in its known hosts file. If the host key is unknown or has changed, the client will display a warning and prompt the user to accept or reject the host key. This is to prevent man-in-the-middle attacks, where an attacker intercepts the connection and pretends to be the legitimate host. The other options are either incorrect or irrelevant to the purpose of an SSH host key. References:

What is an SSH Host Key & How are They Configured?, What are SSH Host Keys? section

SSH Host Key Management Demystified, What are SSH host keys? section

What is SSH host key - omnisecu.com, first paragraph

The ssh-agent command is a program that runs in the background and acts as a key manager for SSH. It can store multiple private keys in memory and provide them to SSH clients when needed. This way, the user does not have to enter the passphrase for each key every time they log in to another machine using SSH. The ssh-agent can also forward the authentication request to another agent running on the original machine, allowing the user to hop between different machines without re-entering the passphrase1.

To use ssh-agent, the user needs to start it and add the private keys to it using the ssh-add command. The ssh-add command can also list, delete, and lock the keys stored in the agent. The user can then use the SSH_AUTH_SOCK environment variable to connect to the agent and use the keys for authentication2.

The other commands are not related to the ssh-agent. The sshd command is the SSH server daemon that listens for incoming connections and handles the authentication and encryption. The ssh-keygen command is a tool for generating, managing, and converting SSH keys. The ssh command is the SSH client that initiates the connection to the remote machine3. References: 1: SSH Essentials: Working with SSH Servers, Clients, and Keys. 2: [ssh-agent(1) - Linux manual page]. 3: SSH command usage, options, and configuration in Linux/Unix.