LFCS 166 🐧 LFCS Practice Scenarios — Services - KandZ

⏱️ Estimated read: 9 min | |

The previous chapters covered the storage and networking practice scenarios. This chapter covers the services practice: the scenarios that simulate the exam tasks in the service management domain. The LFCS service domain is weighted at 15% of the total score, and the objectives cover the systemd unit management, the web server configuration, the SSH server configuration, the time synchronization, the logging, and the firewalld . The critical trap is the configuration versus the runtime distinction. The systemctl start is the runtime. The systemctl enable is the persistence. The httpd.conf edit is the file. The systemctl reload is the apply. The firewalld rule requires the --permanent and the --reload. The scenarios test the complete workflow: the service install, the configuration, the apply, the verification, and the persistence.

Key point: The services scenarios are the end-to-end tasks: the install the service, the configure the service, the apply the configuration, the verify the service, the make the service start at boot, and the open the firewall. The candidate must verify the state with the systemctl status, the ss -tlnp, the curl, the firewall-cmd --list-all, and the journalctl. The scenarios assume the clean VM where the install, the configure, the restart, and the verify are possible.

Why the services practice requires a specific mental model

The runtime versus persistent problem. The systemctl start nginx starts the service now. The reboot stops it. The systemctl enable nginx sets the service to start at boot, but does not start it now. The systemctl enable --now nginx does both. The exam tests both states: the running and the enabled.

The configuration versus apply problem. The httpd.conf edit does nothing until the systemctl reload httpd or the apachectl graceful. The sshd_config edit requires the sshd -t and the systemctl reload sshd. The chronyd configuration requires the systemctl restart chronyd. The scenarios test the apply step.

The firewall problem. The service that listens on the port is not reachable if the firewall blocks the port. The firewalld rule requires the --permanent and the --reload. The ufw allow is the Ubuntu alternative. The scenarios test the firewall-cmd --list-all to verify the service is allowed.

The verification problem. The systemctl status shows the service state. The ss -tlnp shows the listening port. The curl tests the HTTP response. The journalctl -u shows the errors. The scenarios test the state, not the command output.

The trade-off. The services scenarios are the most likely to hit the configuration error that prevents the service from starting. The systemctl status and the journalctl are the diagnostic tools. The practice must include the failure and the recovery.

a. The web server installation and configuration

The scenario: the install the Nginx, the configure the static site, the open the firewall, the verify the response, and the make the service start at boot.

# Install
sudo apt install nginx
# or: sudo dnf install nginx

# Create the site
sudo mkdir -p /var/www/mysite
echo "<h1>My Site</h1>" | sudo tee /var/www/mysite/index.html

# Add the server block (Debian/Ubuntu)
sudo tee /etc/nginx/sites-available/mysite <<'EOF'
server {
    listen 80;
    server_name mysite.local;
    root /var/www/mysite;
    index index.html;
    location / { try_files $uri $uri/ =404; }
}
EOF
sudo ln -s /etc/nginx/sites-available/mysite /etc/nginx/sites-enabled/

# Test and reload
sudo nginx -t
sudo systemctl reload nginx

# Verify
curl -H "Host: mysite.local" http://localhost
ss -tlnp | grep :80

# Enable at boot
sudo systemctl enable nginx

# Firewall
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

The nginx -t validates the syntax. The systemctl reload applies. The curl -H "Host: ..." tests the virtual host. The ss -tlnp shows the listening port. The systemctl enable makes the boot start. The firewall-cmd --permanent --add-service=http opens the port persistently.

b. The SSH server configuration

The scenario: the configure the SSH server to disable the password auth, the change the port, and the restart the service.

# Generate the key (on the client)
ssh-keygen -t ed25519
ssh-copy-id user@server

# Test the key auth
ssh -o PubkeyAuthentication=yes -o PasswordAuthentication=no user@server

# Edit the server config
sudo tee /etc/ssh/sshd_config.d/99-custom.conf <<'EOF'
PasswordAuthentication no
PermitRootLogin no
Port 2222
EOF

# Validate and reload
sudo sshd -t
sudo systemctl reload sshd

# Firewall for the new port
sudo semanage port -a -t ssh_port_t -p tcp 2222
sudo firewall-cmd --permanent --add-port=2222/tcp
sudo firewall-cmd --reload

# Verify
ss -tlnp | grep sshd

The key auth must be tested before the password is disabled. The sshd -t validates the config. The semanage port -a allows the new port in the SELinux. The firewall-cmd --add-port allows it in the firewall. The ss confirms the listening port.

c. The time synchronization and the logging

The scenario: the configure the chronyd to sync with the NTP server, the verify the sync, and the configure the rsyslog to forward the logs.

# Install chrony
sudo apt install chrony

# Configure the NTP servers
sudo tee /etc/chrony/chrony.conf <<'EOF'
pool 2.pool.ntp.org iburst
EOF

# Restart and verify
sudo systemctl restart chrony
chronyc sources
chronyc tracking
timedatectl

# rsyslog forward
sudo tee /etc/rsyslog.d/50-forward.conf <<'EOF'
*.* @@logserver.example.com:514
EOF
sudo rsyslogd -N1
sudo systemctl restart rsyslog

The chronyc sources shows the NTP sources. The chronyc tracking shows the sync status. The timedatectl shows the system time. The rsyslogd -N1 validates the config. The @@ is the TCP forward, the @ is the UDP.

Complete Example Session

# ============================================
# PART 1: INSTALL NGINX
# ============================================

sudo apt install nginx
sudo systemctl enable --now nginx

# ============================================
# PART 2: CONFIGURE THE SITE
# ============================================

sudo mkdir -p /var/www/mysite
echo "<h1>My Site</h1>" | sudo tee /var/www/mysite/index.html

# ============================================
# PART 3: ADD THE SERVER BLOCK
# ============================================

sudo tee /etc/nginx/sites-available/mysite <<'EOF'
server {
    listen 80;
    server_name mysite.local;
    root /var/www/mysite;
}
EOF
sudo ln -s /etc/nginx/sites-available/mysite /etc/nginx/sites-enabled/

# ============================================
# PART 4: TEST AND RELOAD
# ============================================

sudo nginx -t
sudo systemctl reload nginx

# ============================================
# PART 5: VERIFY
# ============================================

curl -H "Host: mysite.local" http://localhost
ss -tlnp | grep :80

# ============================================
# PART 6: FIREWALL
# ============================================

sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

# ============================================
# PART 7: SSH KEY AND CONFIG
# ============================================

ssh-keygen -t ed25519
ssh-copy-id user@server
sudo tee /etc/ssh/sshd_config.d/99-custom.conf <<'EOF'
PasswordAuthentication no
EOF
sudo sshd -t
sudo systemctl reload sshd

# ============================================
# PART 8: TIME SYNC
# ============================================

sudo systemctl restart chrony
chronyc sources
timedatectl

# ============================================
# PART 9: LOG FORWARD
# ============================================

sudo tee /etc/rsyslog.d/50-forward.conf <<'EOF'
*.* @@logserver.example.com:514
EOF
sudo rsyslogd -N1
sudo systemctl restart rsyslog

The nine parts trace the services scenarios: the install, the site, the server block, the reload, the verify, the firewall, the SSH, the time sync, and the log forward.

Quick Reference

Service Management

Command	Purpose
`systemctl start`	Start now
`systemctl enable`	Start at boot
`systemctl enable --now`	Both
`systemctl reload`	Apply the config
`systemctl status`	Show the state

Web Server

Command	Purpose
`nginx -t`	Test the config
`systemctl reload nginx`	Apply
`curl -H "Host: ..."`	Test the virtual host
`ss -tlnp`	Show the listening port

SSH

Command	Purpose
`ssh-keygen`	Generate the key
`ssh-copy-id`	Deploy the key
`sshd -t`	Validate the config
`systemctl reload sshd`	Apply

Time and Log

Command	Purpose
`chronyc sources`	NTP sources
`chronyc tracking`	Sync status
`rsyslogd -N1`	Validate rsyslog
`systemctl restart rsyslog`	Apply

Best Practices

✅ Do This:

sudo systemctl enable --now nginx
<!-- Enable and start in one command -->              # ✅

sudo nginx -t && sudo systemctl reload nginx
<!-- Test before the reload -->                       # ✅

sudo firewall-cmd --permanent --add-service=http && sudo firewall-cmd --reload
<!-- Persistent firewall rule -->                    # ✅

❌ Don’t Do This:

sudo systemctl start nginx
<!-- Not enabled at boot -->                         # ❌

sudo systemctl restart nginx
# For the config change
<!-- Use reload -->                                  # ❌

# Disable the SSH password before the key test
<!-- Locks out the admin -->                         # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Site not reachable	Firewall blocks the port	Open the firewall
Config not applied	No reload	`systemctl reload`
Service not starting at boot	No enable	`systemctl enable`
SSH locked out	Wrong config	`sshd -t` first
NTP not syncing	Wrong server	Check `chronyc sources`

Real-World Examples

1. Install Nginx

apt install nginx

2. Enable

systemctl enable --now nginx

3. Test Config

nginx -t

4. Reload

systemctl reload nginx

5. Firewall

firewall-cmd --permanent --add-service=http && firewall-cmd --reload

6. SSH Key

ssh-copy-id user@server

7. SSH Validate

sshd -t

8. Time Sync

chronyc tracking

9. Log Forward

echo "*.* @@logserver:514" > /etc/rsyslog.d/50-forward.conf

10. Verify

ss -tlnp; curl localhost

Visual

Service Scenario Flow

┌──────────────────────────────────────────────┐
│  Install (apt, dnf)                          │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Configure (nginx.conf, sshd_config)         │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Test (nginx -t, sshd -t)                    │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Reload (systemctl reload)                   │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Verify (ss, curl, firewall-cmd)             │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Persist (systemctl enable, --permanent)     │
└──────────────────────────────────────────────┘

Firewalld Rule

┌──────────────────────────────────────────────┐
│  firewall-cmd --permanent --add-service=http │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  firewall-cmd --reload                       │
│  → Applies the permanent rule                │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  firewall-cmd --list-all                     │
│  → Verify the rule                           │
└──────────────────────────────────────────────┘

Summary

Item	Value
Service start	`systemctl start`
Service boot	`systemctl enable`
Both	`systemctl enable --now`
Apply config	`systemctl reload`
Web test	`nginx -t`
SSH test	`sshd -t`
Firewall	`firewall-cmd --permanent`
Time sync	`chronyc sources`
Log forward	`@@host:port`

Key takeaways:

The enable and the start are separate. The start runs the service now. The enable sets the boot. The enable --now does both. The exam tests both states.
The config edit requires the apply. The nginx -t and the sshd -t validate. The systemctl reload applies. The restart drops the connections; the reload does not.
The firewall is the persistent. The firewall-cmd --permanent writes the rule. The --reload applies. The rule without the --permanent is lost on the reload.
The SSH hardening is the key first. The password disable locks out the admin if the key is not working. The sshd -t validates. The reload applies.
The verification is the state. The ss -tlnp shows the listening port. The curl tests the response. The chronyc tracking shows the sync. The firewall-cmd --list-all shows the rules.

Remember: The services scenarios are the end-to-end tasks. The install, the configure, the test, the reload, the verify, the enable, the firewall. The systemctl is the service. The nginx -t is the check. The firewall-cmd is the port. The chronyc is the time. The exam tests the complete workflow.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!