202-450 LPIC-2 - Exam 202 (part 2 of 2), version 4.5 Questions and Answers

The root directive in Nginx defines the file system path from which the content of the server is retrieved. It can be placed in the http, server, or location contexts. The root directive specifies the root directory that will be used to search for a file. To obtain the path of a requested file, Nginx appends the request URI to the path specified by the root directive. For example, if the root directive is set to /var/www/html and the request URI is /index.php, Nginx will look for the file /var/www/html/index.php. References: Serving Static Content | NGINX DocumentationUnderstanding and Implementing FastCGI Proxying in Nginx

The command that creates a SSH key pair is ssh-keygen. This command generates a public and a private key file that can be used for SSH authentication. The command can take various options to specify the algorithm, the file name, the passphrase, and other parameters for the key pair. For more information, see the web search results below or the man page of ssh-keygen.

How to Use ssh-keygen to Generate a New SSH Key?

 In a BIND zone file, the @ character indicates the name of the zone as defined in the zone statement in named.conf. This is also known as the current origin of the zone file. The @ character is a shortcut that allows the zone file to refer to the zone name without typing it fully. For example, if the zone name is example.com, then the @ character can be used instead of example.com. in the zone file. This can save space and avoid typos123 References:

• LPIC-2 Overview
• LPIC-2 202-450
• What’s the meaning of ‘@’ in a DNS zone file? - Server Fault

The global Postfix configuration file is located at /etc/postfix/main.cf. This file contains the main parameters that control the behavior of the Postfix mail server. It is a plain text file that consists of parameter-value pairs, comments, and blank lines. The syntax of the file is as follows:

parameter = value

commentThe parameter names are case-insensitive, and the values can be enclosed in quotes if they contain spaces or special characters. The values can also reference other parameters by using the $parameter syntax. The file can be edited manually or by using the postconf command. The postconf command can also be used to display the current values of the parameters, or to set new values. For example:

postconf -d # display default values of all parameters postconf -n # display non-default values of all parameters postconf -e ‘parameter = value’ # set a new value for a parameter

The main.cf file is read by Postfix when it starts or reloads. To reload Postfix after making changes to the file, use the command:

postfix reload

References:

• LPIC-2 Exam 202 Objectives, Objective 205.3: Managing a postfix server
• Postfix Basic Configuration, Postfix Documentation
• Postfix Configuration Parameters, Postfix Documentation
• How do I change postfix configuration after installing it?, Server Fault
• What are the Configuration Files for Postfix, The Geek Search

The LDIF excerpt shows the distinguished name (dn) of Robert Smith as “cn=Robert Smith, ou=people, dc=example, dc=com”. The organizational unit (ou) attribute is used to represent an organizational unit in which an entry resides. In this case, Robert Smith is part of the “people” organizational unit.

References:

• [OpenLDAP Software 2.6 Administrator’s Guide: The LDIF File Format]: The official documentation of OpenLDAP on the LDIF file format, which explains the syntax and structure of LDIF entries and attributes.
• [LDAP Data Interchange Format (LDIF) - Version 1]: The RFC 2849 document that defines the LDAP Data Interchange Format (LDIF), which is a common format for exchanging LDAP data.

 The line A is valid in a configuration file in /etc/pam.d/ because it follows the correct syntax and semantics of a PAM configuration file. The syntax of a PAM configuration file is:

module_interface control_flag module_name module_arguments

The module_interface specifies the type of authentication action that the module can perform. There are four types of module interface: auth, account, password, and session. The control_flag specifies how important the success or failure of the module is to the overall authentication process. There are four types of control flag: required, requisite, sufficient, and optional. The module_name specifies the name of the library that contains the module. The module_arguments are optional parameters that can modify the behavior of the module.

The line A has the following components:

• module_interface: auth, which means the module is used for user authentication.
• control_flag: required, which means the module must succeed for authentication to continue. If the module fails, the failure is recorded and the rest of the modules are executed.
• module_name: pam_unix.so, which means the module is the standard Unix authentication module that verifies the user’s password against the /etc/passwd and /etc/shadow files.
• module_arguments: try_first_pass nullok, which means the module tries to use the password that was previously entered by the user (if any), and allows users with empty passwords to log in.

The line B is invalid because it has the wrong order of the fields. The control_flag should come before the module_name, not after. The line C is invalid because it uses parentheses and colons instead of spaces to separate the fields. The line D is invalid because it has the wrong syntax for the control_flag. The control_flag should be a single word, not a word in parentheses.

 The BIND option that should be used to limit the IP addresses from which slave name servers may connect is allow-transfer. This option specifies a list of IP addresses or networks that are allowed to request zone transfers from the master name server. Zone transfers are the mechanism by which slave name servers obtain a copy of the zone data from the master name server. By limiting the IP addresses that can request zone transfers, the master name server can prevent unauthorized access to the zone data and reduce the network load123 References:

• LPIC-2 Overview
• LPIC-2 202-450
• BIND 9 Administrator Reference Manual

Sieve is a programming language used to filter emails by writing simple rules. To combine multiple conditions in a Sieve filter, you can use the allof or anyof keywords. The allof keyword means that all of the conditions must be true for the filter to apply, while the anyof keyword means that at least one of the conditions must be true. For example, the following Sieve filter will assign the label “Important” to any message that is from “boss@example.com” or has the subject “Urgent”:

if anyof (header :contains “From” “boss@example.com”, header :contains “Subject” “Urgent”) { fileinto “Important”; }

The following Sieve filter will assign the label “Spam” to any message that is not from “friend@example.com” and has the subject “Free offer”:

if allof (not header :contains “From” “friend@example.com”, header :contains “Subject” “Free offer”) { fileinto “Spam”; }

References: You can learn more about Sieve filters and logical combinations from the following sources:

• Sieve filter (advanced custom filters) | Proton
• RFC 5228 - Sieve: An Email Filtering Language

To fully disable password based logins for SSH, you need to set both Challenge Response Authentication and Password Authentication to no in the sshd configuration file. These options control whether the server will accept password-based authentication methods such as keyboard-interactive or PAM. Setting them to no will only allow public key authentication or other methods that do not involve passwords. References:

• LPIC-2 Exam 202 Objectives1
• LPIC-2 Exam 202 Study Guide2
• LPIC-2 Exam 202 Topic 208: SSH Configuration3

The newaliases command is a Postfix command that can be used to rebuild all of the alias database files with a single invocation and without the need for any command line arguments. The newaliases command is equivalent to running the postalias command on each file specified by the alias_database parameter in the Postfix main.cf configuration file. The newaliases command reads the text files that contain the alias definitions and creates the indexed files in dbm or db format that are used for fast lookup by the mail system. The newaliases command should be executed whenever the alias database is changed, in order to update the indexed files. For example:

newaliases

The other commands are not equivalent to the newaliases command. The makealiases command is not a valid Postfix command. The postalias command can be used to rebuild a single alias database file, but it requires the file name as an argument. The postmapbuild command is not a valid Postfix command.

References:

• LPIC-2 Exam 202 Objectives, Objective 205.3: Managing a postfix server
• Postfix Basic Configuration, Postfix Documentation
• Postfix manual - aliases(5), Postfix Documentation
• Postfix manual - newaliases(1), Postfix Documentation
• Postfix manual - postalias(1), Postfix Documentation

The command that displays NFS kernel statistics is nfsstat. This command can be used to show information about the number and type of NFS and RPC calls made by the NFS client or server. It can also be used to reset the statistics to zero, or to display information about mounted NFS file systems. The nfsstat command is part of the nfs-utils package and can be installed on most Linux distributions. For more information about the nfsstat command, you can refer to the following resources:

• 1: A Microsoft Learn article that explains the syntax and usage of the nfsstat command on Windows Server.
• 2: A Bing search result page that shows various links and snippets related to the nfsstat command.
• 3: A Red Hat article that demonstrates how to use the nfsstat and nfsiostat commands to troubleshoot NFS performance issues on Linux.

 The mydestination parameter in the Postfix main.cf configuration file specifies the list of domains that are delivered via the $local_transport mail delivery transport. This means that Postfix will accept mail for those domains and deliver it to local mailboxes. To accept mail for both the old and new domain names, the mydestination parameter should include both domains, separated by commas. For example:

mydestination = olddomain.com, newdomain.com, localhost

This will allow Postfix to accept mail for user@olddomain.com and user@newdomain.com and deliver it to the same local user mailbox.

References:

• LPIC-2 Exam 202 Objectives, Objective 205.3: Managing a postfix server
• Postfix Basic Configuration, Postfix Documentation
• Postfix Configuration Parameters: mydestination, Postfix Documentation
• How to configure Postfix to receive mail for multiple domains, Server Fault

The option in named.conf that specifies which hosts are permitted to ask for domain name information from the server is allow-query. The allow-query option is used to define an access control list (ACL) that matches the source IP address of the DNS query. The ACL can be a list of IP addresses, networks, keywords, or predefined ACL names. The default value of allow-query is any, which means that any host can query the server. However, this can pose a security risk, as the server may be exposed to unwanted or malicious queries. Therefore, it is recommended to restrict the allow-query option to only the hosts that need to access the server, such as the local network or trusted clients. For example, the following option allows only the hosts in the 192.168.1.0/24 network and the localhost to query the server:

allow-query { 192.168.1.0/24; localhost; };

The other options are not valid in named.conf. allowed-hosts, accept-query, permit-query, and query-group are not recognized keywords by BIND.

References:

• LPIC-2 exam 202 objectives, topic 208.1, “Implementing a web server”
• BIND 9 Administrator Reference Manual, chapter 6, “Access Control Lists and TSIG”
• How to Configure DNS Server with TSIG on CentOS 8

 The htpasswd command is used to create and update user files for basic authentication of HTTP users. The command has several options, but the most relevant ones for this question are:

• -c: This option creates a new file and overwrites it if it already exists. This is not suitable for changing the password of existing users, as it would erase the previous data.
• -n: This option displays the results on standard output rather than updating a file. This is useful for generating password records for other types of data stores, but not for modifying an existing file.
• -D: This option deletes the specified user from the file. This is not what the question asks for, as it wants to change the password, not remove the user.
• -b: This option uses batch mode, which means getting the password from the command line rather than prompting for it. This option is not mentioned in the question, and it is not recommended for security reasons.

Therefore, the correct option is B, which uses the default syntax of htpasswd to change the password of an existing user in the specified file. The command will prompt for the new password and update the file accordingly.

References:

• htpasswd - Manage user files for basic authentication
• How to Create and Use .htpasswd
• Unlocking htpasswd in Linux: Comprehensive Guide with Examples

The AuthType directive is used to specify the method of authentication for a directory or a location on the Apache HTTPD server. The directive has four possible values: None, Basic, Digest, and Form. Each value corresponds to a different module that implements the authentication mechanism.

• None: This value means that no authentication is required. This is the default value and it can be used to override any inherited authentication settings.
• Basic: This value means that the basic authentication method is used. This method is implemented by the mod_auth_basic module. It requires the user to enter a username and a password, which are sent to the server in plain text. Therefore, this method is not very secure and should be used with encryption, such as SSL or TLS.
• Digest: This value means that the digest authentication method is used. This method is implemented by the mod_auth_digest module. It requires the user to enter a username and a password, which are hashed by the client and the server using a nonce (a random number) and a realm (a name for the protected area). Therefore, this method is more secure than the basic method, as it prevents replay attacks and password sniffing.
• Form: This value means that the form authentication method is used. This method is implemented by the mod_auth_form module. It requires the user to fill out a web form with their credentials, which are sent to the server using the POST method. Therefore, this method is more flexible and user-friendly than the other methods, as it allows the use of custom forms and cookies.

References:

• AuthType Directive
• Authentication and Authorization - Apache HTTP Server Version 2.4
• How to Create and Use .htpasswd

Dovecot supports various authentication mechanisms that can be used to verify the identity of the users who connect to the mail server. Authentication mechanisms are protocols that define how the client and the server exchange the user credentials, such as the username and the password. Some authentication mechanisms are plaintext, which means that the user credentials are sent without any encryption. Others are non-plaintext, which means that the user credentials are protected from eavesdropping or tampering by using some form of encryption or hashing. Dovecot supports the following authentication mechanisms:

• B. digest-md5: This is a non-plaintext mechanism that uses a challenge-response scheme based on the MD5 hash function. The client and the server exchange a series of messages that include a nonce (a random number), a realm (a domain name), and a digest (a hashed combination of the username, password, nonce, and realm). This mechanism prevents replay attacks and supports mutual authentication, meaning that both the client and the server can verify each other’s identity. However, this mechanism is not widely supported by clients and has some security weaknesses12.
• C. cram-md5: This is another non-plaintext mechanism that uses a challenge-response scheme based on the MD5 hash function. The server sends a nonce to the client, and the client responds with the username and a digest of the password and the nonce. This mechanism protects the password from eavesdropping, but does not prevent replay attacks or support mutual authentication. It also requires the server to have access to the plaintext password or a special hashed version of it. This mechanism has somewhat good support in clients12.
• D. plain: This is the simplest and most common plaintext mechanism. The client simply sends the username and the password to the server without any encryption. This mechanism is supported by all clients, but it is vulnerable to eavesdropping and tampering. Therefore, it should only be used with SSL/TLS encryption to secure the connection12.

The other options are not supported by Dovecot as authentication mechanisms. A. ldap is not an authentication mechanism, but a protocol for accessing directory services. E. krb5 is not an authentication mechanism, but a network authentication protocol based on Kerberos. Dovecot supports Kerberos authentication through the GSSAPI mechanism

To create a hidden Samba share, similar to the Windows Administration Share, the share name must end with a dollar sign ().Thiswillpreventthesharefrombeinglistedinthebrowselist,butitcanstillbeaccessedbytypingthefullsharename.OptionAshowsanexampleofahiddenSambasharenamedconfidential, with some additional parameters to configure the share. Option B is incorrect because the share name does not end with a dollar sign. Option C is incorrect because the share name is not enclosed in brackets. Option D is incorrect because the share name contains a space, which is not allowed. Option E is incorrect because the share name is not a valid file name12 References:

• Hiding samba share from browse list for unauthorised users
• Creating a samba share where everyone has write access

The command in the question is using the ldapsearch tool to query an LDAP directory. The filter expression is (|(cn=marie)(!(telephoneNumber=9*))), which means to match entries that satisfy either one of the two conditions inside the parentheses. The first condition is (cn=marie), which means the common name attribute (cn) of the entry is equal to marie. The second condition is (!(telephoneNumber=9*)), which means the telephone number attribute (telephoneNumber) of the entry is not equal to 9 followed by any number of characters. The ! operator means logical negation, and the * operator means wildcard matching. Therefore, the command will return entries that have a cn of marie or don’t have a telephoneNumber beginning with 9. References: LPIC-2 202 exam objectives, LDAP Search Filters

The redirect action in a Sieve filter forwards a message to another email address without changing the message. The redirect action takes a single argument, which is the email address to forward the message to. The syntax of the redirect action is as follows:

redirect "email_address";

The redirect action does not affect the delivery of the message to the original recipient, unless the stop or keep actions are used. The redirect action can be combined with other actions or tests to create more complex filters. For example, the following Sieve filter will forward any messages from Alice to Bob, and then stop processing the rest of the script:

require "fileinto"; if address :is "from" "alice@example.com" { redirect "bob@example.com"; stop; }

References:

• LPIC-2 Exam 202 Objectives, Objective 205.4: Managing a dovecot server
• Sieve filter (advanced custom filters) | Proton, Proton Mail Support
• Sieve: An Email Filtering Language, RFC 5228
• Sieve Email Filtering | Tiger Technologies Support, Tiger Technologies Support
• [Sieve: A Mail Filtering Language], Sieve.Info

 The unknown-clients statement in the ISC DHCPD configuration is used to specify whether or not an address pool can be used by nodes which have a corresponding host section in the configuration. A host section is a declaration that defines a static IP address for a specific client based on its MAC address or other identifier. An unknown client is a client that does not have a host section. The unknown-clients statement can be either allow, deny, or ignore, and it can be applied to a pool, a subnet, or a shared-network. For example, the following configuration allows unknown clients to use the pool of addresses from 192.168.1.100 to 192.168.1.200, but denies them from using the pool of addresses from 192.168.1.201 to 192.168.1.254:

subnet 192.168.1.0 netmask 255.255.255.0 { pool { range 192.168.1.100 192.168.1.200; allow unknown-clients; } pool { range 192.168.1.201 192.168.1.254; deny unknown-clients; } }

References:

• ISC DHCP 4.4 Manual Pages - dhcpd.conf: The official documentation of ISC DHCPD on how to configure the dhcpd.conf file, which includes the description of the unknown-clients statement and examples.
• How To Configure a DHCP Server on Ubuntu 20.04 | DigitalOcean: A tutorial from DigitalOcean on how to configure a DHCP server on Ubuntu 20.04, which includes the use of the unknown-clients statement and host sections.

 TCP/IP stack fingerprinting is a technique that allows nmap to remotely detect the characteristics of a TCP/IP stack implementation on a target host. By sending a series of probes (such as TCP and UDP packets) and analyzing the responses, nmap can infer the operating system (OS) of the target host based on a database of known OS fingerprints. Each OS has a unique way of setting certain parameters and flags in the TCP/IP headers, such as the initial packet size, the initial TTL, the window size, the max segment size, the window scaling value, and the “don’t fragment”, “sackOK”, and “nop” flags. These values can be combined to form a signature or a fingerprint for the target host, which can then be compared to the nmap-os-db database that contains more than 2,600 OS fingerprints. If there is a match, nmap will print out the OS details, such as the name, the version, and the vendor. If there is no match, nmap will print out a message asking the user to submit the fingerprint to the nmap project for further analysis.

TCP/IP stack fingerprinting is useful for several purposes, such as network mapping, security auditing, vulnerability scanning, and penetration testing. By knowing the OS of the target host, nmap can tailor its scanning techniques and exploit the weaknesses of the specific OS. TCP/IP stack fingerprinting can also help identify rogue or unauthorized devices on a network, or detect OS spoofing attempts by the target host.

References:

• OS Detection | Nmap Network Scanning
• TCP/IP stack fingerprinting - Wikipedia
• Cybersecurity | Nmap | OS Detection | Codecademy

 To log into a remote SSH server using SSH keys, the client needs to generate a public and private key pair using the ssh-keygen utility. The private key (~/.ssh/id_rsa) should be kept secret and protected by a passphrase, while the public key (~/.ssh/id_rsa.pub) should be copied to the remote server’s authorized_keys file (~/.ssh/authorized_keys) using the ssh-copy-id utility or manually. The authorized_keys file contains the public keys of the clients that are allowed to log into the server using SSH keys. The client can then use the ssh command with the -i option to specify the private key file to authenticate to the server without entering a password. References:

• LPIC-2 Exam 202 Objectives, Topic 212: System Security, 212.3 Secure shell (SSH) (weight: 4)
• How To Configure SSH Key-Based Authentication on a Linux Server

How To Configure SSH Key-Based Authentication on a Linux Server

 The error message in the image is saying that the program vsftpd is unable to find the required shared library file. This is because the program is running in a chroot jail, which restricts the program’s access to the file system. To fix this error, the required library file must be copied to the appropriate lib directory in the chroot jail. This will allow the program to access the file and run properly. References:

• LPIC-2 Overview
• LPIC-2 201-450
• LPIC-2 202-450

The word missing from the excerpt of a named.conf file is “acl”. This is because the excerpt is defining an access control list (ACL) for the DNS server. The ACL is used to restrict access to the DNS server and is defined in the named.conf file. The syntax for defining an ACL is:

acl name { address_match_list; };

where name is the name of the ACL, and address_match_list is a list of IP addresses, networks, or keywords that match the clients that are allowed or denied access.References:

• LPIC-2 Overview
• LPIC-2 202-450
• BIND 9 Administrator Reference Manual

The verbose_proctitle parameter in the Dovecot configuration file controls whether Dovecot adds extra information to its process titles. When this parameter is set to yes, Dovecot will show the username, IP address of the peer, and the connection status for each process. This can help to associate the processes with users and peers, and to monitor the activity of the mail server. For example, the process titles may look like this:

dovecot/imap-login user@domain.com [192.168.0.1] dovecot/imap user@domain.com [192.168.0.1] IDLE

The verbose_proctitle parameter can be set in the /etc/dovecot/dovecot.conf file or in the /etc/dovecot/conf.d/10-master.conf file. The default value is no, which means that Dovecot will only show the process name and the command state. For example:

dovecot/imap-login dovecot/imap [idling]

The other options are not related to the process titles. The --with-linux-extprocnames option for ./configure when building Dovecot is not a valid option. The sys.ps.allow_descriptions and proc.all.show_status parameters in sysctl.conf or /proc are not valid parameters. The process_format parameter in the Dovecot configuration is used to specify the format of the process name, not the process title.

References:

• LPIC-2 Exam 202 Objectives, Objective 205.4: Managing a dovecot server
• Process Titles — Dovecot documentation, Dovecot Documentation
• Dovecot Configuration Parameters: verbose_proctitle, Dovecot Documentation
• Dovecot Configuration Parameters: process_name, Dovecot Documentation
• How to monitor dovecot processes? - Server Fault, Forum

DNSSEC adds digital signatures to DNS records, which can be verified by the clients using public keys. This way, DNSSEC ensures that the DNS responses are authentic and have not been tampered with by attackers. DNSSEC does not encrypt DNS queries or answers, nor does it authenticate the user or the nameserver123

What is DNSSEC on DNS Server in Windows Server?1

How DNSSEC Works | Cloudflare

The PAM module that sets and unsets environment variables is pam_env. This module allows the (un)setting of environment variables based on the rules specified in the configuration file /etc/security/pam_env.conf or an alternative file. The module can also read a file with simple KEY=VAL pairs on separate lines (/etc/environment by default) or a user-specific file ($HOME/.pam_environment by default). The pam_env module supports the use of previously set environment variables as well as PAM_ITEMs such as PAM_RHOST. The pam_env module should be the last one on the stack, as setting PAM environment variables can have side effects on other modules. The pam_env module provides the auth and session module types. References:

• pam_env - PAM module to set/unset environment variables
• pam_env(8) - Linux manual page

 OpenSSL is a software library that provides cryptographic functions and tools for creating and managing SSL/TLS certificates. One of the tools included in OpenSSL is the command-line utility openssl, which can be used to generate various types of cryptographic objects, such as private keys, public keys, certificate signing requests (CSRs), and certificates. A CSR is a file that contains the information needed by a certificate authority (CA) to issue a digital certificate for a web server. A CSR includes the public key of the web server, the domain name or names that the certificate will cover, and some identifying information about the organization or individual requesting the certificate. To generate a CSR for serving HTTPS with Apache HTTPD, the openssl command can be used with the req option, which stands for request. The req option takes several parameters, such as -new, -newkey, -nodes, -keyout, and -out, to specify the details of the CSR generation process. For example, the following command will generate a new private key and a new CSR for the domain example.com, using a 2048-bit RSA algorithm, and saving the files as example.key and example.csr respectively:

openssl req -new -newkey rsa:2048 -nodes -keyout example.key -out example.csr

The command will also prompt the user to enter some information for the CSR, such as the country code, state or province name, locality name, organization name, organizational unit name, common name, and email address. The common name is the most important field, as it should match the domain name or names that the certificate will cover. For example, if the certificate is for example.com, the common name should be example.com. If the certificate is for multiple domains, such as example.com and www.example.com, the common name should be one of them, and the rest should be specified as subject alternative names (SANs) in a configuration file. After the CSR is generated, it can be sent to a CA for signing and obtaining a certificate, which can then be installed and configured on the Apache HTTPD server to enable HTTPS.

References:

• OpenSSL: The official website of the OpenSSL project, which provides documentation, downloads, and support for the OpenSSL software.
• Apache: CSR & SSL Installation (OpenSSL) - DigiCert: A guide from DigiCert on how to create a CSR and install an SSL certificate on an Apache server using OpenSSL.
• How to Generate a Certificate Signing Request (CSR) for Apache Web Server Using OpenSSL - The SSL Store™: A tutorial from The SSL Store on how to generate a CSR for an Apache web server using OpenSSL.
• GoDaddy - Apache: Generate CSR (Certificate Signing Request): A step-by-step instruction from GoDaddy on how to generate a CSR for Apache 2.x using OpenSSL.

 The NFSv4 pseudo file system is a virtual file system that provides a single root directory for all the exports on the NFS server. It allows the clients to see all the exports as a single file system, regardless of their physical locations on the server. The pseudo file system usually contains bind mounts of the directory trees to be exported, which are created using the mount --bind command. Bind mounts create a second mount point for an existing directory, without changing its attributes or permissions. This way, the pseudo file system can include directories from different file systems or partitions on the server123 References:

• NFSv4Howto - Community Help Wiki
• NFSv4: Enhancements and Best Practices Guide - NetApp
• File-System Namespace in NFS Version 4 - Oracle

To allow X connections to be forwarded from or through an SSH server, the configuration keyword that must be set to yes in the sshd configuration file is XllForwarding. This keyword enables X11 forwarding, which is a mechanism that allows graphical applications to be run on a remote host and displayed on a local host. The sshd configuration file is usually located at /etc/ssh/sshd_config, and the XllForwarding keyword can be set globally or per host. For example:

XllForwarding yes

This will enable X11 forwarding for all hosts. To enable X11 forwarding for a specific host, use the Match directive, followed by the Host keyword and the host name or pattern. For example:

Match Host example.com XllForwarding yes

This will enable X11 forwarding only for the host example.com.

References:

• X11 Forwarding using SSH
• sshd_config - OpenSSH SSH daemon configuration file
• How To Configure X11 Forwarding Using SSH In Linux

The Samba configuration parameter writeable is a synonym for the parameter read only. It has the opposite meaning, so setting writeable=no is equivalent to setting read only=yes. This parameter controls whether a user has the ability to create or modify files within a share12 References:

• LPIC-2 Overview
• LPIC-2 202-450
• smb.conf - Samba
• Samba share permissions simplified - nixCraft

The root element of the LDAP tree holding the configuration of an OpenLDAP server that is using directory based configuration is called cn=config. This is a special entry that is not part of the regular data DITs, but rather a separate DIT that can be used to configure the OpenLDAP server online. The cn=config entry contains various subentries that define the global and database-specific settings for the server. The cn=config entry can be accessed and modified using standard LDAP tools and methods, such as ldapsearch and ldapmodify12.

References:

• OpenLDAP Software 2.6 Administrator’s Guide: Configuring slapd: The official documentation of OpenLDAP on how to configure the slapd daemon, which includes the description of the cn=config entry and its subentries.
• How To Configure OpenLDAP and Perform Administrative LDAP Tasks | DigitalOcean: A tutorial from DigitalOcean on how to configure OpenLDAP and perform administrative LDAP tasks, which includes the use of the cn=config entry and the ldapsearch and ldapmodify tools.