LPI 202-450 Online Access

The root element of the LDAP tree holding the configuration of an OpenLDAP server that is using directory based configuration is called cn=config. This is a special entry that is not part of the regular data DITs, but rather a separate DIT that can be used to configure the OpenLDAP server online. The cn=config entry contains various subentries that define the global and database-specific settings for the server. The cn=config entry can be accessed and modified using standard LDAP tools and methods, such as ldapsearch and ldapmodify12.

References:

• OpenLDAP Software 2.6 Administrator’s Guide: Configuring slapd: The official documentation of OpenLDAP on how to configure the slapd daemon, which includes the description of the cn=config entry and its subentries.
• How To Configure OpenLDAP and Perform Administrative LDAP Tasks | DigitalOcean: A tutorial from DigitalOcean on how to configure OpenLDAP and perform administrative LDAP tasks, which includes the use of the cn=config entry and the ldapsearch and ldapmodify tools.

 Reverse DNS queries are used to find the domain name associated with an IP address. To perform reverse DNS queries, DNS servers use a special type of record called PTR (pointer) record. A PTR record maps an IP address to a hostname in the reverse lookup zone. For example, a PTR record for the IP address 185.230.63.186 would point to the hostname unalocated.63.wixsite.com. Reverse DNS queries are useful for validating email servers, troubleshooting network problems, and identifying malicious hosts. References:

• 2 Ways to Perform Reverse DNS lookups in Linux - howtouselinux
• Linux managing DNS servers (LPIC-2) · GitHub
• LPI Linux Certification/LPIC2 Exam 202/DNS - Wikibooks

The Require directive in mod_authz_core selects which authenticated users can access a resource. The directive takes one or more arguments that specify the authorization provider and the criteria for granting access. Some of the built-in authorization providers are:

• all: This provider matches all users, regardless of the criteria. It can be used to grant or deny access to everyone. For example, Require all granted allows access to everyone, while Require all denied denies access to everyone.
• ip: This provider matches the client IP address against a list of IP addresses, network/netmask pairs, or CIDR specifications. It can be used to allow or deny access based on the client’s location. For example, Require ip 192.168.1.0/24 allows access only to clients from the 192.168.1.0/24 subnet.
• host: This provider matches the client hostname against a list of domain names. It can be used to allow or deny access based on the client’s DNS name. For example, Require host example.com allows access only to clients whose hostname ends with example.com.
• local: This provider matches the client IP address against the server IP address. It can be used to allow or deny access based on whether the client is local or remote. For example, Require local allows access only to clients that connect to the server via the loopback interface.
• user: This provider matches the authenticated username against a list of usernames. It can be used to allow or deny access based on the user identity. For example, Require user alice bob allows access only to users alice and bob.
• group: This provider matches the authenticated user’s group membership against a list of groups. It can be used to allow or deny access based on the user’s group affiliation. For example, Require group admins allows access only to users who belong to the admins group.
• valid-user: This provider matches any authenticated user, regardless of the username. It can be used to allow or deny access based on the user authentication status. For example, Require valid-user allows access to any user who can provide valid credentials.
• expr: This provider evaluates an expression and grants or denies access based on the result. It can be used to implement complex logic based on various variables and functions. For example, Require expr "%{REQUEST_METHOD} == 'GET' && %{TIME_HOUR} < 12" allows access only to GET requests made before noon.
• method: This provider matches the request method against a list of methods. It can be used to allow or deny access based on the type of request. For example, Require method GET POST allows access only to GET and POST requests.
• regex: This provider matches the request URI against a regular expression. It can be used to allow or deny access based on the pattern of the request. For example, Require regex ^/admin/.* allows access only to requests that start with /admin/.

Therefore, the correct strings that can be used as an argument to Require are B, C, and E. Statement A is false because method is not a valid argument to Require, but a separate authorization provider. Statement D is false because header is not a valid argument to Require, but a variable that can be used in an expression.

References:

• mod_authz_core - Apache HTTP Server Version 2.4
• Access Control - Apache HTTP Server Version 2.4