LFCS Exam Dumps : Linux Foundation Certified System Administrator (LFCS)

Objective: Configure persistent Linux resource limits for the existing user james, ensuring that:

The hard process limit is 32768.

The soft process limit is 16384.

The limits are applied when the user starts a new PAM-managed login session.

The configuration remains available after a system reboot.

The appropriate solution uses Linux-PAM's resource-limit configuration, typically in /etc/security/limits.d/.

The official Linux-PAM documentation specifies the configuration syntax and confirms that nproc is the resource identifier for process limits.

Step 1: Connect to the correct Linux server.

The video specifies host lfcs00089.

From the candidate terminal, execute:

ssh lfcs00089

This establishes an SSH session with the designated server.

All subsequent configuration changes must be performed on this host.

Step 2: Verify that the user james exists.

Execute:

id james

This displays the user's UID, primary group and supplementary group memberships.

Example output:

uid=1001(james) gid=1001(james) groups=1001(james)

The numeric identifiers may differ on the actual server.

You can also check the account database:

getent passwd james

The task specifies an existing user, so there is no need to create a new account or modify the user's password.

Step 3: Understand soft and hard process limits.

Linux implements process-related resource restrictions using RLIMIT_NPROC.

Limit

Required value

Purpose

Soft

16384

Default process/thread creation limit enforced for the user's processes

Hard

32768

Maximum value to which an unprivileged user may raise the soft limit

The hard limit must be at least as large as the soft limit. Here:

\[ 16384 \leq 32768 \]

Therefore, the requested configuration is valid.

On Linux, RLIMIT_NPROC actually accounts for processes and threads associated with the real user ID, subject to kernel privilege exceptions. It is not a separate allowance for every running application.

Step 4: Inspect any existing persistent limits.

Before changing the system, execute:

sudo cat /etc/security/limits.conf

Then list any existing supplemental configuration files:

sudo ls -la /etc/security/limits.d/

Search specifically for process-limit settings:

sudo grep -RnsE \

'^[[:space:]]*([^#[:space:]] +[[:space:]]+)+(soft|hard|-)[[:space:]] +nproc' \

/etc/security/limits.conf /etc/security/limits.d/ 2 > /dev/null

Also check for any existing entries concerning james:

sudo grep -RnsE '^[[:space:]]*james[[:space:]] ' \

/etc/security/limits.conf /etc/security/limits.d/ 2 > /dev/null

These checks help identify existing user-specific limits and avoid contradictory configuration entries.

Step 5: Understand the persistent configuration locations.

The primary resource-limit configuration file is:

/etc/security/limits.conf

Additional administrator-defined limits can be stored under:

/etc/security/limits.d/

Both locations are supported by Linux-PAM.

The configuration format is:

< domain > < type > < item > < value >

For this task:

Field

Required value

Description

Domain

james

Existing username

Type

soft or hard

Which resource limit to configure

Item

nproc

Number of processes/threads

Value

16384 or 32768

Required limit

A dedicated configuration file is preferable because it keeps the account-specific policy separate from the system's general resource-limit settings.

Step 6: Create the persistent configuration file.

Execute:

sudo nano /etc/security/limits.d/90-james-nproc.conf

This opens a new configuration file.

If the file already exists, inspect its contents before modifying it.

Step 7: Add the required soft and hard process limits.

Insert the following two lines:

james soft nproc 16384

james hard nproc 32768

This is the exact configuration required for the task.

Explanation of the first line:

james soft nproc 16384

james selects the target user.

soft specifies the default soft resource limit.

nproc refers to the process/thread limit.

16384 establishes the required soft value.

Explanation of the second line:

james hard nproc 32768

james selects the same user.

hard specifies the hard resource limit.

nproc identifies the resource.

32768 establishes the maximum hard value.

These settings apply specifically to james rather than all users.

The Linux-PAM manual explicitly supports user-specific soft and hard nproc entries.

Step 8: Save the configuration.

If using Nano:

Press Ctrl + O to save.

Press Enter to confirm the filename.

Press Ctrl + X to exit.

If using Vim:

Press Esc.

Type :wq.

Press Enter.

The file should be located at:

/etc/security/limits.d/90-james-nproc.conf

Step 9: Verify the saved configuration.

Execute:

sudo cat /etc/security/limits.d/90-james-nproc.conf

Expected output:

james soft nproc 16384

james hard nproc 32768

Check the file permissions:

ls -l /etc/security/limits.d/90-james-nproc.conf

A typical configuration file has permissions of 644 and is owned by root.

If the file permissions are incorrect, restore appropriate permissions:

sudo chmod 644 /etc/security/limits.d/90-james-nproc.conf

The file should be readable by the PAM module when login sessions are established.

Step 10: Verify that PAM applies resource limits.

The settings are interpreted by the PAM module:

pam_limits.so

Check whether the module is configured:

sudo grep -Rns 'pam_limits.so' /etc/pam.d/

A relevant configuration entry resembles:

session required pam_limits.so

session identifies the PAM session-management phase.

required means the module must succeed for the relevant PAM operation to succeed.

pam_limits.so applies the configured resource limits when the session is established.

The official Linux-PAM documentation confirms that this module applies resource limits to user sessions.

On Ubuntu, inspect the PAM configuration used by the relevant login method, including sshd, login, su, and any referenced common-session files.

Do not blindly add duplicate pam_limits.so entries. If the module is absent from the actual login path, configure it appropriately before testing.

Step 11: Understand when the changes take effect.

The limits defined in /etc/security/limits.d/90-james-nproc.conf are persistent settings, but they are not automatically applied to every currently running process.

Linux-PAM applies these limits when an applicable new login session begins.

Therefore:

Existing sessions may retain their previous limits.

New PAM-managed sessions can receive the new values.

Changes survive reboot because the configuration is stored on disk.

There is no need to restart the entire operating system simply to load the configuration.

The Linux-PAM manual specifically explains that configured resource limits are applied per login session.

Step 12: Start a fresh session as james.

If you have administrative access, you can attempt to create a new login session with:

sudo su - james

This starts a login-style shell using the su PAM service, provided that service is configured to apply PAM resource limits.

Alternatively, open a new SSH login as james, using the account's existing credentials if permitted:

ssh james@localhost

A fresh SSH login is particularly useful if the actual login service is the intended target of the configuration.

Check the active user:

whoami

Expected:

james

Do not assume that simply running sudo -u james ulimit ... is a valid test. ulimit is a shell builtin, and changing the execution user does not necessarily create a PAM session or apply its resource-limit policy.

Step 13: Verify the soft process limit.

Inside the new login session belonging to james, execute:

ulimit -Su

ulimit displays or controls process resource limits.

-S selects the soft limit.

-u selects the maximum process/thread resource limit.

Expected output:

16384

This confirms that the session received the required soft limit.

Step 14: Verify the hard process limit.

In the same session, execute:

ulimit -Hu

-H selects the hard limit.

-u selects the process/thread resource limit.

Expected output:

32768

The GNU Bash manual confirms that -S and -H distinguish soft and hard limits, and that -u refers to the maximum number of processes available to a user.

Step 15: Verify both limits together.

Execute:

printf 'Soft limit: '

ulimit -Su

printf 'Hard limit: '

ulimit -Hu

Expected output:

Soft limit: 16384

Hard limit: 32768

This is the most direct practical verification of the two requested values.

Step 16: Verify the kernel's process-limit information.

Linux also exposes resource limits through the /proc filesystem.

Inside the new james session, execute:

cat /proc/self/limits

Find the line:

Max processes

The relevant values should be:

Limit Soft Limit Hard Limit

Max processes 16384 32768

The displayed output contains additional columns and other resource limits, but the Max processes entry is the one relevant to this task.

For a more concise check, execute:

grep 'Max processes' /proc/self/limits

Expected values:

Max processes 16384 32768

You can also use:

prlimit --pid $$

This displays resource limits for the current shell process.

Step 17: Check for conflicting limits if the values are incorrect.

If the new session does not show the required values, investigate rather than repeatedly adding duplicate configuration entries.

First, inspect user-specific rules:

sudo grep -Rns 'james' \

/etc/security/limits.conf /etc/security/limits.d/

Next, inspect all process-limit rules:

sudo grep -Rns 'nproc' \

/etc/security/limits.conf /etc/security/limits.d/

Then check whether pam_limits.so is active in the login method used for testing.

Potential reasons for an unexpected value include an overriding limits configuration, a session started without PAM resource-limit processing, or resource limits imposed by a systemd-managed service.

If the user runs an application under a systemd service, systemd's LimitNPROC= setting may also be relevant. However, configuring a systemd service is not required by the task.

Step 18: Verify persistence.

The persistent configuration resides at:

/etc/security/limits.d/90-james-nproc.conf

Execute:

sudo cat /etc/security/limits.d/90-james-nproc.conf

Expected:

james soft nproc 16384

james hard nproc 32768

Because this configuration is stored under /etc, it remains present after the system reboots unless it is changed or removed.

For end-to-end verification, start a fresh login session after reboot and repeat:

ulimit -Su

ulimit -Hu

Expected:

16384

32768

A reboot is not necessary for normal verification, and should not be performed unnecessarily during the LFCS exam.

Step 19: Confirm that unrelated users remain unchanged.

The file contains rules for:

james

It does not use the wildcard:

*

Therefore, this particular configuration does not apply indiscriminately to all users.

Avoid adding entries such as:

* soft nproc 16384

* hard nproc 32768

Those would impose the specified limits more broadly, instead of targeting the user named in the task.

Step 20: Perform final verification.

The final configuration must satisfy all requirements:

Requirement

Expected result

Existing user

james

Resource type

nproc

Soft limit

16384

Hard limit

32768

Persistent configuration

Present

Fresh login session

Correct limits applied

Other users

No unnecessary changes

Final Solution

The essential commands are:

Copy commands

# Connect to the correct server

ssh lfcs00089

# Verify the user exists

id james

# Create the persistent resource-limit configuration

printf '%s\n' \

'james soft nproc 16384' \

'james hard nproc 32768' | \

sudo tee /etc/security/limits.d/90-james-nproc.conf

# Verify the configuration

sudo cat /etc/security/limits.d/90-james-nproc.conf

# Confirm PAM resource-limit integration

sudo grep -Rns 'pam_limits.so' /etc/pam.d/

# Start a new PAM-managed login session

# (provided the su PAM stack applies pam_limits)

sudo su - james

# Verify the soft limit

ulimit -Su

# Verify the hard limit

ulimit -Hu

# Verify through procfs

grep 'Max processes' /proc/self/limits

The required configuration is:

james soft nproc 16384

james hard nproc 32768

Technical Verification and References

Linux-PAM limits.conf(5) — Confirms the configuration file syntax and nproc resource identifier.

Linux-PAM pam_limits(8) — Explains how limits are applied when PAM sessions are established.

GNU Bash — ulimit — Documents soft and hard resource-limit verification.

Linux getrlimit(2) — Defines the kernel's process-limit behavior.

Video verification finding: At approximately 29:01–29:05, Question 9 appears with host lfcs00089. The recording shows the full task statement but does not demonstrate the required configuration being completed. The solution above is independently validated against Linux-PAM documentation.

Expected result: User james receives a soft process limit of 16384 and a hard process limit of 32768 in applicable new login sessions. The settings are stored persistently and remain configured after reboot.

Objective: Create a new virtual machine using the existing Ubuntu 22.04 disk image, allocate 1024 MiB of RAM, register the virtual machine with libvirt, and ensure virt-install exits without opening an interactive console.

The correct solution uses virt-install with the --import and --noautoconsole options. The --import option is essential because the task provides an existing operating system disk image rather than requesting a fresh installation.

Step 1: Connect to the correct Linux server.

The video specifies that this task must be completed on host lfcs00083.

From the candidate terminal, execute:

ssh lfcs00083

This connects to the virtualization host where the VM must be created.

All subsequent commands must be executed on this host.

Step 2: Verify that virtualization tools are available.

Check the virt-install utility:

virt-install --version

Check the virsh utility:

virsh --version

Also check the QEMU image-management utility:

qemu-img --version

These tools serve different purposes:

virt-install creates and configures virtual machines.

virsh manages and inspects virtual machines through libvirt.

qemu-img examines and manages virtual disk images.

The task states that libvirt must be used, so creating the VM directly with a standalone qemu-system command would not be the appropriate solution.

Step 3: Verify connectivity to the libvirt hypervisor.

Execute:

sudo virsh --connect qemu:///system list --all

virsh communicates with the libvirt virtualization manager.

--connect qemu:///system selects the system-wide QEMU/KVM connection.

list --all displays both running and stopped virtual machines.

An illustrative result is:

Id Name State

--------------------------------

1 existing-vm running

- test-vm shut off

The actual VM list will depend on the host.

If libvirt cannot be contacted, check the host's libvirt services and sockets:

sudo systemctl status libvirtd

Some systems use modular libvirt daemons such as virtqemud, so inspect the installed service arrangement rather than assuming libvirtd is always present.

Step 4: Check whether cool-moray already exists.

Execute:

sudo virsh --connect qemu:///system list --all

Look for a virtual machine named:

cool-moray

You can check directly:

sudo virsh --connect qemu:///system dominfo cool-moray

If libvirt reports that the domain does not exist, proceed.

If the domain already exists, inspect it before making changes. Do not delete or recreate an existing machine without establishing why it is present.

The --name option of virt-install requires a name unique to the target libvirt connection.

Step 5: Verify that the existing disk image is present.

The task specifies the exact disk image path:

/vms/cool-moray/jammy-server-cloudimg-amd64.img

Execute:

ls -lh /vms/cool-moray/jammy-server-cloudimg-amd64.img

If normal user permissions do not allow inspection:

sudo ls -lh /vms/cool-moray/jammy-server-cloudimg-amd64.img

The image must exist before creating the VM.

Do not create an empty virtual disk in its place. The requirement is to use the existing disk image.

Step 6: Inspect the existing virtual disk image.

Execute:

sudo qemu-img info /vms/cool-moray/jammy-server-cloudimg-amd64.img

An example of the resulting information is:

image: /vms/cool-moray/jammy-server-cloudimg-amd64.img

file format: qcow2

virtual size: 2 GiB

disk size: 650 MiB

These size values are illustrative.

qemu-img info identifies the image's format, virtual size, actual allocated storage, and any backing image relationship.

Ubuntu cloud images commonly use QCOW2, but verify the actual image format instead of assuming it from the .img extension.

The existing image must remain intact.

Step 7: Confirm the guest operating-system type.

The disk filename contains:

jammy-server-cloudimg-amd64.img

jammy refers to Ubuntu 22.04 LTS, and amd64 indicates the x86-64 architecture.

Check the installed OS profiles:

virt-install --osinfo list

To find Ubuntu 22.04 specifically:

virt-install --osinfo list | grep -i ubuntu22

If ubuntu22.04 is available, it can be selected using:

--osinfo ubuntu22.04

This provides appropriate guest operating-system metadata and configuration defaults.

If that profile is unavailable, the upstream Ubuntu cloud-image procedure supports using:

--osinfo generic

Do not install a new operating system or download a different disk image merely to complete the task.

Step 8: Create the virtual machine using virt-install.

Once the disk exists, the libvirt connection works and the Ubuntu profile is supported, execute:

sudo virt-install \

--connect qemu:///system \

--name cool-moray \

--memory 1024 \

--disk path=/vms/cool-moray/jammy-server-cloudimg-amd64.img \

--osinfo ubuntu22.04 \

--import \

--noautoconsole

This is the principal solution.

If ubuntu22.04 is not recognized by the installed libosinfo database, substitute --osinfo generic, following the official Ubuntu cloud-image instructions.

The command leaves CPU count, network configuration and other parameters at their supported defaults because the visible task does not prescribe specific values for them.

Step 9: Understand every parameter in the command.

Parameter

Explanation

sudo

Executes with administrative privileges

virt-install

Creates and defines a VM through libvirt

--connect qemu:///system

Targets the system-wide QEMU/KVM hypervisor

--name cool-moray

Assigns the required VM name

--memory 1024

Allocates 1024 MiB of guest memory

--disk path=...

Attaches the existing virtual disk image

--osinfo ubuntu22.04

Selects the Ubuntu 22.04 operating-system profile

--import

Boots an existing OS image without running an installer

--noautoconsole

Prevents automatic attachment to the guest console and allows the command to return

Three arguments are especially important.

--memory 1024

The task specifies memory of 1024 MB. The virt-install utility interprets this parameter in MiB.

Therefore:

--memory 1024

sets the guest's configured RAM to 1024 MiB, equivalent to 1 GiB.

--import

This tells virt-install to create the VM around an existing disk image and skip the operating-system installation process.

Without an appropriate installation method such as --import, virt-install may expect installation media or fail to determine how the guest should be created.

--noautoconsole

The task explicitly requires this flag.

It prevents virt-install from automatically connecting to the guest's graphical or text console. Official documentation states that it also allows virt-install to exit promptly rather than waiting on an interactive console session.

Step 10: Verify that the creation command succeeds.

When virt-install succeeds, it normally prints messages indicating that the VM has been created and the domain is being started.

An illustrative successful message could be:

Starting install...

Creating domain...

Domain creation completed.

Do not treat these example messages as an actual result from the video.

Immediately after the command completes, check the exit status:

echo $?

Expected successful exit status:

0

If the command fails, read the actual error before attempting it again.

Common failure conditions include an existing VM name, inaccessible image path, unsupported OS profile, missing virtualization support or an unavailable default network.

Step 11: Verify that the new virtual machine is registered.

Execute:

sudo virsh --connect qemu:///system list --all

The output should now contain:

cool-moray

For example:

Id Name State

---------------------------

2 cool-moray running

The domain ID and runtime state may differ.

This command verifies that libvirt recognizes the VM.

Step 12: Verify the virtual machine's assigned memory.

Execute:

sudo virsh --connect qemu:///system dominfo cool-moray

Inspect the memory information.

For a VM configured with 1024 MiB, an expected value is:

Max memory: 1048576 KiB

Calculation:

\[ 1024 \times 1024 = 1,048,576 \text{ KiB} \]

This confirms that libvirt has the required memory allocation.

Also verify the VM name and general status in the same output.

Step 13: Verify the attached virtual disk.

Execute:

sudo virsh --connect qemu:///system domblklist cool-moray --details

The output should identify a disk whose source is:

/vms/cool-moray/jammy-server-cloudimg-amd64.img

This verifies that the VM uses the exact existing image required by the task.

Do not confuse creating a new blank disk with attaching the existing disk. The latter is required.

Step 14: Inspect the VM's persistent configuration.

Execute:

sudo virsh --connect qemu:///system dumpxml cool-moray

This displays the libvirt domain definition in XML format.

Look for the guest name:

< name > cool-moray < /name >

Also inspect the memory setting and the disk source.

The relevant configuration should contain the equivalent of:

< memory unit='KiB' > 1048576 < /memory >

And a disk source referencing:

< source file='/vms/cool-moray/jammy-server-cloudimg-amd64.img'/ >

The actual XML may include additional attributes, devices, generated addresses and machine-specific settings.

Step 15: Verify the VM's runtime state.

Execute:

sudo virsh --connect qemu:///system domstate cool-moray

A successful initial launch should normally report:

running

If it reports shut off, investigate the reason:

sudo virsh --connect qemu:///system dominfo cool-moray

You can also inspect the appropriate libvirt/QEMU logs.

Importing a cloud image registers and starts a guest, but it does not automatically establish guest login credentials or configure cloud-init user data. Those operations are not requested by this task.

Step 16: Verify that virt-install has returned control to the terminal.

Because --noautoconsole was specified, the virt-install command should return to the shell after initiating VM creation.

For example, the terminal prompt should become available again:

candidate@lfcs00083:~$

The presence of the normal shell prompt indicates that the creation utility is no longer occupying the terminal.

This is separate from the VM's own runtime state: the virtual machine may continue running after virt-install exits.

Step 17: Perform final verification.

Execute:

sudo virsh --connect qemu:///system list --all

sudo virsh --connect qemu:///system dominfo cool-moray

sudo virsh --connect qemu:///system domblklist cool-moray --details

sudo virsh --connect qemu:///system domstate cool-moray

Confirm the following:

Requirement

Expected result

VM name

cool-moray

Existing disk image

/vms/cool-moray/jammy-server-cloudimg-amd64.img

Memory

1024 MiB

Installation method

Existing image imported

Mandatory option

--noautoconsole used

VM registration

Present in libvirt

VM initial startup

Successful

Terminal

Returns to shell after creation

Final Solution

The essential commands are:

# Connect to the designated server

ssh lfcs00083

# Verify the existing disk image

ls -lh /vms/cool-moray/jammy-server-cloudimg-amd64.img

# Inspect the image

sudo qemu-img info /vms/cool-moray/jammy-server-cloudimg-amd64.img

# Check the VM name is available

sudo virsh --connect qemu:///system list --all

# Confirm the guest OS profile exists

virt-install --osinfo list

# Create the VM

sudo virt-install \

--connect qemu:///system \

--name cool-moray \

--memory 1024 \

--disk path=/vms/cool-moray/jammy-server-cloudimg-amd64.img \

--osinfo ubuntu22.04 \

--import \

--noautoconsole

# Verify the new VM

sudo virsh --connect qemu:///system list --all

sudo virsh --connect qemu:///system dominfo cool-moray

sudo virsh --connect qemu:///system domblklist cool-moray --details

sudo virsh --connect qemu:///system domstate cool-moray

Technical Verification and References

The solution is based on the official virt-install, libvirt and Ubuntu cloud-image documentation.

Ubuntu virt-install(1) Manual — Describes the --memory, --disk, --import, --osinfo and --noautoconsole options.

libvirt virsh Command Reference — Documents VM inspection commands, including list, dominfo, domblklist and domstate.

Ubuntu — Launch QCOW Cloud Images Using libvirt — Provides a practical example of launching an existing Ubuntu cloud image with virt-install, --import and --noautoconsole.

Video verification finding: At approximately 28:30, the recording shows Question 7 and the required host lfcs00083. The candidate begins entering the SSH command but cancels it and moves to Question 8. The recording therefore does not demonstrate a successful VM creation. The solution above is independently documentation-validated, not confirmed as executed in that recording.

Expected result: A virtual machine named cool-moray is created and registered through libvirt using the existing Ubuntu image, with 1024 MiB RAM. The VM starts successfully, and virt-install exits without attaching to the VM's console.

Objective: Enable IPv4 packet forwarding on the Linux server and ensure that the setting remains enabled after a system reboot.

In Linux, IPv4 forwarding is controlled by the kernel parameter:

net.ipv4.ip_forward

This parameter determines whether the Linux kernel can forward IPv4 packets between network interfaces.

Value

Meaning

0

IPv4 forwarding disabled

1

IPv4 forwarding enabled

The task requires a persistent configuration, not merely a temporary runtime change.

The official Linux kernel documentation confirms that setting net.ipv4.ip_forward to 1 enables forwarding of IPv4 packets.

Step 1: Connect to the correct Linux server.

The video specifies that this task must be completed on host lfcs00081.

From the candidate terminal, execute:

ssh lfcs00081

This establishes an SSH session with the designated server.

All remaining commands must be executed on this host.

Step 2: Inspect the current IP forwarding configuration.

Execute:

sysctl net.ipv4.ip_forward

This displays the current value of the IPv4 forwarding parameter.

If forwarding is disabled, the output is:

net.ipv4.ip_forward = 0

If forwarding is already enabled, the output is:

net.ipv4.ip_forward = 1

You can also inspect the corresponding kernel interface directly:

cat /proc/sys/net/ipv4/ip_forward

Expected output when forwarding is disabled:

0

The /proc/sys/ hierarchy provides an interface for viewing and modifying runtime kernel parameters.

Step 3: Check the existing persistent configuration.

Before modifying anything, check whether the parameter is already configured elsewhere.

Execute:

sudo grep -RnsE '^[[:space:]]*net\.ipv4\.ip_forward[[:space:]] *=' \

/etc/sysctl.conf /etc/sysctl.d/ \

/run/sysctl.d/ /usr/lib/sysctl.d/ 2 > /dev/null

This searches the relevant sysctl configuration files.

For example, the output might include:

/etc/sysctl.conf:28:net.ipv4.ip_forward=0

This indicates that the existing configuration explicitly disables IPv4 forwarding.

If the parameter appears in multiple files, inspect the effective configuration order before changing it.

Step 4: Enable IPv4 forwarding immediately.

Execute:

sudo sysctl -w net.ipv4.ip_forward=1

sudo executes the command with administrative privileges.

sysctl reads or modifies kernel parameters.

-w writes a new value to a kernel parameter.

net.ipv4.ip_forward=1 enables IPv4 forwarding.

Expected output:

net.ipv4.ip_forward = 1

This change takes effect immediately.

However, this command alone does not guarantee persistence after reboot.

Therefore, additional configuration is required.

Step 5: Create a persistent sysctl configuration file.

The preferred method on a systemd-based Linux system is to create a dedicated file in:

/etc/sysctl.d/

Execute:

sudo nano /etc/sysctl.d/99-lfcs-ip-forward.conf

Add this exact line:

net.ipv4.ip_forward = 1

Save the file.

The complete file should contain:

net.ipv4.ip_forward = 1

Why this works:

/etc/sysctl.d/ stores persistent administrator-defined kernel settings.

.conf files in this directory are read during system startup.

The filename prefix 99- normally positions the file after most package-provided configuration files.

The setting enables IPv4 forwarding whenever it is applied.

The systemd sysctl.d(5) documentation confirms that these configuration files are used to apply kernel parameters during boot.

Step 6: Check for settings that could override the new value.

A particularly important consideration is /etc/sysctl.conf.

On Ubuntu systems using the procps implementation, sysctl --system processes /etc/sysctl.conf after the configuration files in sysctl.d.

Therefore, an existing entry such as:

net.ipv4.ip_forward = 0

inside /etc/sysctl.conf could override the value in the new file when sysctl --system is executed.

Inspect it:

sudo grep -n 'net.ipv4.ip_forward' /etc/sysctl.conf

If an active, conflicting entry is present, edit it:

sudo nano /etc/sysctl.conf

Change:

net.ipv4.ip_forward = 0

to:

net.ipv4.ip_forward = 1

Alternatively, remove the duplicate active entry and rely on the dedicated /etc/sysctl.d/99-lfcs-ip-forward.conf file.

Do not modify unrelated sysctl parameters.

The official sysctl(8) manual documents how --system processes configuration files and how /etc/sysctl.conf can override earlier values.

Step 7: Apply the persistent configuration immediately.

Execute:

sudo sysctl --system

This loads the sysctl settings from the system configuration.

The relevant output should include:

net.ipv4.ip_forward = 1

Review the command output for conflicting settings or errors.

Check the command's exit status immediately:

echo $?

A successful execution should normally return:

0

Step 8: Verify that IPv4 forwarding is enabled in the running kernel.

Execute:

sysctl net.ipv4.ip_forward

Expected:

net.ipv4.ip_forward = 1

Verify through the kernel interface:

cat /proc/sys/net/ipv4/ip_forward

Expected:

1

These two commands confirm the same runtime kernel setting through different interfaces.

Step 9: Verify the persistent configuration file.

Execute:

cat /etc/sysctl.d/99-lfcs-ip-forward.conf

Expected output:

net.ipv4.ip_forward = 1

You can also confirm that the setting remains active after reapplying its configuration:

sudo sysctl --system

sysctl net.ipv4.ip_forward

The final result should remain:

net.ipv4.ip_forward = 1

This confirms both that the runtime setting is enabled and that the system configuration can reapply it successfully.

Step 10: Verify persistence after a reboot, if permitted.

The strongest practical verification is to reboot the server and check the parameter afterward.

Only perform this step if rebooting the exam host is permitted and you can reconnect safely.

Execute:

sudo reboot

After the server finishes restarting, reconnect:

ssh lfcs00081

Then execute:

sysctl net.ipv4.ip_forward

Expected:

net.ipv4.ip_forward = 1

If the value remains 1, IPv4 forwarding has been restored successfully during startup.

Important: A reboot is not necessary to apply the change. sudo sysctl --system is sufficient for immediate activation. Avoid an unnecessary reboot during an exam if the required state can already be verified.

Step 11: Understand why both runtime and persistent changes matter.

There are two separate requirements to consider:

Configuration method

Immediate effect

Persistent after reboot

sudo sysctl -w net.ipv4.ip_forward=1

Yes

No, by itself

Write 1 to /proc/sys/net/ipv4/ip_forward

Yes

No, by itself

Configure /etc/sysctl.d/*.conf

After loading

Yes

Configure /etc/sysctl.conf on the Ubuntu setup

After loading

Yes

sudo sysctl --system

Applies configured values

Does not itself create persistence

The correct solution must leave the runtime parameter enabled and store the configuration in a location that is processed at startup.

Step 12: Confirm that IPv4 forwarding does not require additional configuration for this task.

The question asks only to enable the IP forwarding kernel feature persistently.

It does not request:

Configuring network interfaces.

Creating routing tables.

Adding NAT or firewall rules.

Enabling IPv6 forwarding.

Installing a routing daemon.

Therefore, these additional changes are unnecessary.

Enabling the kernel's forwarding feature allows Linux to forward IPv4 packets, but successful routing between networks can still depend on interface configuration, routing tables, and firewall policies.

Those are separate operational concerns and are not part of the stated task.

Step 13: Perform the final verification.

Execute:

sysctl net.ipv4.ip_forward

Expected:

net.ipv4.ip_forward = 1

Then:

cat /proc/sys/net/ipv4/ip_forward

Expected:

1

Finally:

cat /etc/sysctl.d/99-lfcs-ip-forward.conf

Expected:

net.ipv4.ip_forward = 1

The resulting configuration must satisfy the following:

Requirement

Expected result

IPv4 forwarding enabled

Yes

Runtime kernel parameter

1

Persistent configuration

Present

Settings reapply successfully

Yes

Other kernel parameters

Unchanged unless affected by the kernel's forwarding transition

IPv4 forwarding after reboot

Enabled

Final Solution

Copy commands

# Connect to the correct server

ssh lfcs00081

# Check current IPv4 forwarding status

sysctl net.ipv4.ip_forward

# Enable IPv4 forwarding immediately

sudo sysctl -w net.ipv4.ip_forward=1

# Make the setting persistent

printf 'net.ipv4.ip_forward = 1\n' | \

sudo tee /etc/sysctl.d/99-lfcs-ip-forward.conf

# Check for a conflicting setting in /etc/sysctl.conf

sudo grep -n 'net.ipv4.ip_forward' /etc/sysctl.conf

# Resolve any active conflicting entry if present,

# then apply persistent settings

sudo sysctl --system

# Verify the effective kernel setting

sysctl net.ipv4.ip_forward

# Verify directly through procfs

cat /proc/sys/net/ipv4/ip_forward

# Verify the persistent configuration

cat /etc/sysctl.d/99-lfcs-ip-forward.conf

Alternative Solution — Method Demonstrated in the Video

The candidate in the recording edits:

sudo vim /etc/sysctl.conf

This is also a valid approach on the Ubuntu environment shown.

Inside the file, locate the IPv4 forwarding setting:

#net.ipv4.ip_forward=1

If the line is commented out, uncomment it so it reads:

net.ipv4.ip_forward=1

If an active entry is already set to 0, change it to 1 instead. Ensure there are no contradictory active entries.

Save and apply:

sudo sysctl -p /etc/sysctl.conf

Verify:

sysctl net.ipv4.ip_forward

Expected:

net.ipv4.ip_forward = 1

Both approaches are valid. A dedicated file under /etc/sysctl.d/ is preferable for keeping administrator-specific changes separate, whereas editing /etc/sysctl.conf closely follows the method attempted in the recording. Use one consistent configuration and ensure no conflicting setting overrides it.

Technical Verification and References

The solution has been checked against official Linux and systemd documentation:

Linux Kernel — IP Sysctl Documentation — Defines the IPv4 forwarding parameter and its behavior.

Linux sysctl(8) — Documents runtime modification and applying system configuration.

systemd sysctl.d(5) — Explains persistent kernel settings loaded during startup.

Video verification finding: At approximately 28:20–29:10, the recording shows Task 8 on host lfcs00081. The candidate edits /etc/sysctl.conf and executes a reboot. However, the visible recording does not establish the precise final contents of the file or show a successful post-reboot check of net.ipv4.ip_forward.

Expected result: The Linux system has IPv4 forwarding enabled with net.ipv4.ip_forward = 1, and the setting is configured to remain enabled after reboot.