202-450 Exam Dumps - LPIC-2 - Exam 202 (part 2 of 2), version 4.5

mount-tnfsv4 server://mnt

of an NFC-Client, it is observed that /mnt contains the content of the server’s /usr directory instead of the content of the NFSv4 foot folder.

Which option in /etc/exports has to be changed or removed in order to make the NFSv4 root folder appear when mounting the highest level of the server? (Specify ONLY the option name without any values or parameters.)

Answer:  fsid

The fsid option in /etc/exports is used to specify a unique identifier for each exported filesystem. For NFSv4, there is a distinguished filesystem which is the root of all exported filesystems, and it is specified with fsid=root or fsid=0, both of which mean the same thing. If this option is used for the /exports directory, then it will be the root of the NFSv4 hierarchy, and any subdirectories under it will be mounted relative to it. This means that when mounting the highest level of the server, the client will see the content of /exports instead of the NFSv4 root folder. To avoid this, the fsid option should be removed or changed to a different value for the /exports directory, so that it is not the NFSv4 root. The other options in /etc/exports are not relevant for this question.

 The command exportfs is used to configure which file systems a NFS server makes available to clients. The exportfs command maintains a table of exported file systems in the /etc/exports file, which specifies the directories to be shared and the options for each host or network. The exportfs command can also be used to add, remove, or refresh the exported file systems without restarting the NFS service123 References:

• 8.6. Configuring the NFS Server - Red Hat Customer Portal
• How to configure NFS on Linux - Learn Linux Configuration
• How to configure Network File System on Linux | Enable Sysadmin

 The htpasswd command is used to create and update user files for basic authentication of HTTP users. The command has several options, but the most relevant ones for this question are:

• -c: This option creates a new file and overwrites it if it already exists. This is not suitable for changing the password of existing users, as it would erase the previous data.
• -n: This option displays the results on standard output rather than updating a file. This is useful for generating password records for other types of data stores, but not for modifying an existing file.
• -D: This option deletes the specified user from the file. This is not what the question asks for, as it wants to change the password, not remove the user.
• -b: This option uses batch mode, which means getting the password from the command line rather than prompting for it. This option is not mentioned in the question, and it is not recommended for security reasons.

Therefore, the correct option is B, which uses the default syntax of htpasswd to change the password of an existing user in the specified file. The command will prompt for the new password and update the file accordingly.

References:

• htpasswd - Manage user files for basic authentication
• How to Create and Use .htpasswd
• Unlocking htpasswd in Linux: Comprehensive Guide with Examples

 The NFSv4 pseudo file system is a virtual file system that provides a single root directory for all the exports on the NFS server. It allows the clients to see all the exports as a single file system, regardless of their physical locations on the server. The pseudo file system usually contains bind mounts of the directory trees to be exported, which are created using the mount --bind command. Bind mounts create a second mount point for an existing directory, without changing its attributes or permissions. This way, the pseudo file system can include directories from different file systems or partitions on the server123 References:

• NFSv4Howto - Community Help Wiki
• NFSv4: Enhancements and Best Practices Guide - NetApp
• File-System Namespace in NFS Version 4 - Oracle

To allow X connections to be forwarded from or through an SSH server, the configuration keyword that must be set to yes in the sshd configuration file is XllForwarding. This keyword enables X11 forwarding, which is a mechanism that allows graphical applications to be run on a remote host and displayed on a local host. The sshd configuration file is usually located at /etc/ssh/sshd_config, and the XllForwarding keyword can be set globally or per host. For example:

XllForwarding yes

This will enable X11 forwarding for all hosts. To enable X11 forwarding for a specific host, use the Match directive, followed by the Host keyword and the host name or pattern. For example:

Match Host example.com XllForwarding yes

This will enable X11 forwarding only for the host example.com.

References:

• X11 Forwarding using SSH
• sshd_config - OpenSSH SSH daemon configuration file
• How To Configure X11 Forwarding Using SSH In Linux

The AuthType directive is used to specify the method of authentication for a directory or a location on the Apache HTTPD server. The directive has four possible values: None, Basic, Digest, and Form. Each value corresponds to a different module that implements the authentication mechanism.

• None: This value means that no authentication is required. This is the default value and it can be used to override any inherited authentication settings.
• Basic: This value means that the basic authentication method is used. This method is implemented by the mod_auth_basic module. It requires the user to enter a username and a password, which are sent to the server in plain text. Therefore, this method is not very secure and should be used with encryption, such as SSL or TLS.
• Digest: This value means that the digest authentication method is used. This method is implemented by the mod_auth_digest module. It requires the user to enter a username and a password, which are hashed by the client and the server using a nonce (a random number) and a realm (a name for the protected area). Therefore, this method is more secure than the basic method, as it prevents replay attacks and password sniffing.
• Form: This value means that the form authentication method is used. This method is implemented by the mod_auth_form module. It requires the user to fill out a web form with their credentials, which are sent to the server using the POST method. Therefore, this method is more flexible and user-friendly than the other methods, as it allows the use of custom forms and cookies.

References:

• AuthType Directive
• Authentication and Authorization - Apache HTTP Server Version 2.4
• How to Create and Use .htpasswd

 TSIG stands for Transaction SIGnature, which is a mechanism for authenticating DNS messages using a shared secret key and a cryptographic hash algorithm. TSIG can be used to secure DNS updates, zone transfers, and queries between DNS servers and clients. To configure a BIND server to use TSIG, the following parameters should be added to the named.conf file:

• A key statement that defines the name, algorithm, and secret of the TSIG key. The name can be any arbitrary string, the algorithm can be one of the supported algorithms such as hmac-md5, hmac-sha1, hmac-sha256, etc., and the secret can be a base64-encoded string that represents the shared secret key. For example:

key “server.example.com” { algorithm hmac-md5; secret “skrKc4DoTzi/takIlPi7JZA==”; };

• A server statement that specifies the IP address or hostname of the remote server that will use the TSIG key, and the name of the key that should be used for communication. For example:

server 192.168.1.10 { keys { “server.example.com”; }; };

• A zone statement that indicates the zone name, type, and file of the zone that will use TSIG, and the name of the key that should be used for updates or transfers. For example:

zone “example.com” { type master; file “example.com.zone”; allow-update { key “server.example.com”; }; allow-transfer { key “server.example.com”; }; };

Option E shows the correct configuration parameters that should be added if the server should use the algorithm hmac-md5 and the key skrKc4DoTzi/takIlPi7JZA==. The other options are incorrect because they either use the wrong syntax, the wrong algorithm, the wrong key name, or the wrong secret.

References:

• LPIC-2 exam 202 objectives, topic 208.2, “Securing a DNS server”
• BIND 9 Administrator Reference Manual, chapter 6, “Access Control Lists and TSIG”
• How to Configure DNS Server with TSIG on CentOS 8

The option that would tell OpenVPN to use a dynamic source port when making a connection to a peer is nobind. This option instructs OpenVPN to not bind to a specific local port number, but instead use an ephemeral port number chosen by the operating system. This allows multiple OpenVPN instances to connect to the same remote server or peer without port conflicts. The other options are either invalid or have different meanings:

• src-port: This is not a valid OpenVPN option and will cause an error.
• remote: This option specifies the host name or IP address and port number of the remote server or peer to connect to. It does not affect the source port of the client.
• source-port: This is not a valid OpenVPN option and will cause an error.
• dynamic-bind: This is not a valid OpenVPN option and will cause an error.

References: LPIC-2 202 exam objectives, LPIC-2 202-450 Exam Prep: Network Configuration, Reference Manual For OpenVPN 2.4