Server & service configuration
Configure web servers, mail, certificates and VMs on a bare host.
20 project-authored proposals · taxonomy v1.1 · 0 new benchmark runs. Verifiers and partial-credit rules below are designs, not executed results.
- Typical applications
- nginx · postfix · OpenSSL · QEMU
- Class GUI-need label
CL· CLI-sufficient
Task proposals · 20
Expand to inspect the complete original wording and proposed checks. Original proposal text remains English in both interfaces.
R03.04.01.04-T01 nginx static site with gzip and cache headers
Original instruction
On a fresh Ubuntu VM, serve the files in /srv/site on nginx port 80. Enable gzip for text/css and application/javascript, set Cache-Control: max-age=604800 for *.css and *.js, and return a custom 404 from /srv/site/404.html. Reload without downtime.
- Platforms
lin· Linux- Applications
- nginx
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
curl -I of a .css asset shows Content-Encoding: gzip and Cache-Control max-age=604800; GET /missing returns 404 with the custom body; nginx -t exits 0 and master PID unchanged after reload.
Proposed partial credit
40% site served on :80; 30% gzip+cache headers correct; 30% custom 404 + graceful reload
R03.04.01.04-T02 nginx reverse proxy with TLS termination
Original instruction
A backend app listens on 127.0.0.1:3000. Configure nginx as an HTTPS reverse proxy on :443 using fixtures/server.crt and fixtures/server.key, redirect :80 to :443, set X-Forwarded-Proto and Host upstream headers, and enable HTTP/2. Keep the backend unreachable from outside.
- Platforms
lin· Linux- Applications
- nginx · OpenSSL
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
openssl s_client to :443 negotiates h2 and the configured cert; curl http://host 301-redirects to https; upstream receives X-Forwarded-Proto=https; :3000 refused from a non-loopback address.
Proposed partial credit
30% TLS on :443 with correct cert; 25% HTTP/2; 25% forwarded headers; 20% 80->443 redirect + backend firewalled
R03.04.01.04-T03 nginx rate limiting and request logging
Original instruction
Protect /api/ on an existing nginx site: limit each client IP to 10 req/s with burst 20 (nodelay), return 429 on excess, and log to /var/log/nginx/api.log in a custom log_format including $request_time and $limit_req_status. Leave other locations unthrottled.
- Platforms
lin· Linux- Applications
- nginx
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
A scripted burst of 50 req to /api/ yields some 429s and all 200s elsewhere; api.log lines match the custom format and contain $request_time; limit_req_zone present in config; nginx -t exits 0.
Proposed partial credit
40% limit_req zone+rule active with 429; 35% custom log_format fields; 25% other locations unaffected
R03.04.01.04-T04 Apache virtual hosts with rewrite rules
Original instruction
On a host with Apache2, configure two name-based vhosts: shop.test (docroot /var/www/shop) and blog.test (docroot /var/www/blog). On blog.test, 301-rewrite /old/(.*) to /new/$1 and force trailing slashes on directory URLs. Enable only the modules you need.
- Platforms
lin· Linux- Applications
- Apache
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
Host-header requests resolve each docroot; GET blog.test/old/x returns 301 to /new/x; apachectl -S lists both vhosts; mod_rewrite enabled; apachectl configtest = Syntax OK.
Proposed partial credit
40% both vhosts resolve; 35% rewrite 301 correct; 25% trailing-slash + minimal modules
R03.04.01.04-T05 Caddy automatic HTTPS with internal CA
Original instruction
Write a Caddyfile serving app.localhost as a reverse proxy to 127.0.0.1:8080 using Caddy's internal CA (tls internal), add a /healthz endpoint that returns 200 'ok', and compress responses. Install so it starts on boot via its systemd unit.
- Platforms
lin· Linux- Applications
- Caddy
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
caddy validate passes; https://app.localhost serves the proxy with a cert from Caddy's local CA; /healthz returns 200 'ok'; systemctl is-enabled caddy = enabled.
Proposed partial credit
35% reverse proxy over TLS internal; 30% healthz; 20% compression; 15% boot-enabled unit
R03.04.01.04-T06 Postfix + Dovecot virtual mailbox server (sandbox)
Original instruction
On an isolated test VM, stand up Postfix (SMTP) + Dovecot (IMAP) for the test domain mail.lab serving two virtual users from fixtures/vmailboxes.cf. Enable submission on 587 with STARTTLS using fixtures/mail.crt/key and Maildir delivery. Use only loopback/lab network; no external relay.
- Platforms
lin· Linux- Applications
- postfix · Dovecot
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 5 / 5
Proposed verifier
swaks to :587 with STARTTLS delivers to a virtual user's Maildir; IMAP login retrieves the message; postconf shows virtual_mailbox_domains=mail.lab; relayhost empty and open-relay test from a lab client is rejected.
Proposed partial credit
30% SMTP accepts+delivers to Maildir; 30% IMAP retrieval; 25% 587 STARTTLS; 15% no open relay
R03.04.01.04-T07 Postfix relay with TLS and header rewriting
Original instruction
Configure Postfix on relay.lab to relay only for 10.0.0.0/24, enforce opportunistic outbound TLS (smtp_tls_security_level=may), rewrite the envelope sender domain internal.lab to corp.lab via sender_canonical, and cap message size to 25 MB. Reject mail from other networks.
- Platforms
lin· Linux- Applications
- postfix
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
postconf shows mynetworks limited to 10.0.0.0/24, message_size_limit=26214400, smtp_tls_security_level=may; a test send rewrites sender to @corp.lab (Maildir headers); submission from outside the network is rejected with 554.
Proposed partial credit
35% relay restricted to subnet; 30% sender canonical rewrite; 20% TLS level; 15% size cap
R03.04.01.04-T08 OpenSSL self-signed cert with SAN and key perms
Original instruction
Generate a 2048-bit RSA key and a self-signed X.509 cert for CN=web.lab valid 365 days with subjectAltName DNS:web.lab,DNS:www.web.lab,IP:10.0.0.5. Write key to /etc/ssl/private/web.lab.key (0600, root:root) and cert to /etc/ssl/certs/web.lab.crt (0644). Verify the cert.
- Platforms
lin· Linux- Applications
- OpenSSL
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
openssl x509 -text shows CN=web.lab, the three SANs, 365-day validity, RSA 2048; stat shows key 0600 root:root and cert 0644; openssl verify (self) succeeds.
Proposed partial credit
40% valid cert with correct CN+validity; 35% all three SANs; 25% file modes/owners
R03.04.01.04-T09 Build a two-tier CA and issue a server cert
Original instruction
Using OpenSSL, create a root CA and an intermediate CA (pathlen:0), then issue a server cert for api.lab signed by the intermediate with EKU serverAuth and SAN DNS:api.lab. Produce fullchain.pem (server+intermediate) and verify it chains to the root.
- Platforms
lin· Linux- Applications
- OpenSSL
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
openssl verify -CAfile root.pem -untrusted intermediate.pem server.crt = OK; server cert has EKU serverAuth and SAN api.lab; intermediate has CA:TRUE pathlen:0; fullchain.pem contains server then intermediate in order.
Proposed partial credit
30% root+intermediate with correct constraints; 35% server cert signed by intermediate; 20% EKU+SAN; 15% verified fullchain
R03.04.01.04-T10 Issue a cert from a local ACME CA (step-ca)
Original instruction
A smallstep step-ca ACME endpoint runs at https://ca.lab:9000/acme/acme/directory in the lab. Configure the host's ACME client to obtain a cert for svc.lab via HTTP-01, install it for nginx on :443, and set up automatic renewal via a systemd timer. No public internet.
- Platforms
lin· Linux- Applications
- OpenSSL · nginx
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
nginx on :443 serves a cert issued by the step-ca intermediate (openssl s_client issuer check); the ACME account+order succeeded (client state); a renewal systemd timer exists and a dry-run renew succeeds.
Proposed partial credit
40% cert issued via ACME HTTP-01; 35% installed+served on :443; 25% renewal timer works
R03.04.01.04-T11 QEMU Alpine VM with SSH networking
Original instruction
Boot an Alpine image in QEMU (user-mode networking) with 1 GB RAM, forward host port 2222 to guest 22, and enable SSH for a test user with fixtures/id_test.pub. The VM must come up headless and accept key-based SSH from the host.
- Platforms
lin· Linux- Applications
- QEMU
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
ssh -p 2222 -i fixtures/id_test localhost uname -a succeeds non-interactively; the qemu process shows hostfwd=tcp::2222-:22 and 1024M RAM; password SSH disabled (key only).
Proposed partial credit
40% VM boots headless; 35% port-forwarded key SSH works; 25% RAM+key-only policy
R03.04.01.04-T12 QEMU VM with telnet serial console
Original instruction
Start a QEMU Linux VM exposing its serial console over a telnet socket on 127.0.0.1:4555 (server,nowait), with no graphical display, so an operator can drive the boot and login over the console. Confirm the login prompt is reachable over telnet.
- Platforms
lin· Linux- Applications
- QEMU
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
A scripted telnet to 127.0.0.1:4555 receives kernel boot output and a login: prompt; qemu invocation contains -serial telnet:127.0.0.1:4555,server,nowait and -nographic/-display none.
Proposed partial credit
50% VM boots to a reachable serial login over telnet; 30% correct serial redirection flags; 20% headless
R03.04.01.04-T13 systemd service with socket activation and hardening
Original instruction
Package the binary /opt/echo/echod as a socket-activated systemd service: a echod.socket listening on TCP 7000 and echod.service started on first connection, running as a dynamic user with ProtectSystem=strict and NoNewPrivileges. Enable both units.
- Platforms
lin· Linux- Applications
- systemd
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
systemd-analyze verify passes both units; connecting to :7000 cold-starts echod.service (journal shows socket activation); systemctl show reports DynamicUser=yes, NoNewPrivileges=yes, ProtectSystem=strict; both units enabled.
Proposed partial credit
35% socket+service units valid; 30% activation on connect; 35% hardening directives set
R03.04.01.04-T14 HAProxy L7 load balancer with health checks
Original instruction
Configure HAProxy to load-balance https frontend :443 (terminate TLS with fixtures/lb.pem) across backends 10.0.0.11:8080 and 10.0.0.12:8080 using round-robin with HTTP health checks on /healthz, draining an unhealthy backend. Expose the stats page on :8404 (admin:fixtures password).
- Platforms
lin· Linux- Applications
- HAProxy
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 5 / 5
Proposed verifier
haproxy -c -f cfg = valid; repeated requests alternate backends; when one /healthz returns 500 it is marked DOWN on the stats page and traffic shifts; :443 serves the lb.pem cert.
Proposed partial credit
35% TLS frontend + 2 backends round-robin; 35% health check drains unhealthy; 30% stats page auth
R03.04.01.04-T15 Authoritative DNS zone with BIND
Original instruction
Configure BIND9 as authoritative for zone corp.lab: A records for www (10.0.0.20) and mail (10.0.0.21), an MX pointing to mail, an SPF TXT 'v=spf1 mx -all', and a CNAME ftp->www. Set SOA serial to today's date format and enable zone-file checking.
- Platforms
lin· Linux- Applications
- BIND
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
named-checkzone corp.lab passes; dig @localhost resolves www/mail A, MX to mail with correct priority, TXT SPF, ftp CNAME; SOA serial matches YYYYMMDDnn; named-checkconf clean.
Proposed partial credit
40% zone loads+serves A/MX; 30% CNAME+TXT SPF; 30% valid SOA+checkzone
R03.04.01.04-T16 PostgreSQL service config and host auth
Original instruction
Configure a PostgreSQL instance to listen on 10.0.0.30:5432, accept scram-sha-256 auth for role appuser on database appdb from 10.0.0.0/24 only (reject others), set max_connections=100 and shared_buffers=256MB, and reload. Local socket superuser access stays trust.
- Platforms
lin· Linux- Applications
- PostgreSQL
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
SHOW listen_addresses/max_connections/shared_buffers match; psql from a 10.0.0.x client as appuser (scram) connects; a client outside the subnet is rejected by pg_hba; config reload (not restart) applied non-runtime settings pending flag clear.
Proposed partial credit
35% listen+tuning params; 35% scram hba rule for subnet; 30% others rejected + reload
R03.04.01.04-T17 Redis with auth, persistence and bind
Original instruction
Harden a Redis service: bind to 127.0.0.1 and 10.0.0.40 only, require a password from fixtures/redis_pass, enable AOF persistence (appendfsync everysec), rename the FLUSHALL command to a random token, and set maxmemory 512mb with allkeys-lru. Restart cleanly.
- Platforms
lin· Linux- Applications
- Redis
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
redis-cli -a <pass> CONFIG GET shows appendonly yes, maxmemory 512mb, maxmemory-policy allkeys-lru, bind addresses; unauthenticated PING is denied; FLUSHALL is unknown while the renamed token works; AOF file present.
Proposed partial credit
30% auth+bind; 25% AOF persistence; 25% maxmemory policy; 20% renamed command
R03.04.01.04-T18 Samba share with per-user access
Original instruction
Export a Samba share 'team' from /srv/team readable by group staff and writable only by user lead (from fixtures/smbusers). Disable guest access, force create mode 0660, and advertise the share. Keep SMB1 disabled (min protocol SMB2).
- Platforms
lin· Linux- Applications
- Samba
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commandstype· Text & forms- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
testparm reports the 'team' share with the right valid users/write list, guest ok = no, create mask 0660, server min protocol = SMB2; a staff user mounts read-only and lead can write; guest mount fails.
Proposed partial credit
35% share exported with correct perms; 30% write-list vs read-only; 20% no guest; 15% SMB2 minimum
R03.04.01.04-T19 Provision a LAMP host via Cockpit web console (control pair of T01)
Original instruction
Control pair of T01: on a VM running the Cockpit web console (https://host:9090), use only the browser UI to install the Apache+PHP role, start and enable httpd, open the firewall for http, and create the vhost docroot /var/www/app with the provided index.php. Do not use a terminal.
- Platforms
lin· Linuxweb· Any OS (web)- Applications
- Cockpit · Apache
- Interfaces
brow· Browser- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
G2· GUI-essential- Interaction primitives
click· Point & clicktype· Text & formsnav· Pan/zoom/scroll- Work product
WP08· App/system state- Conditions
tutorial· Follow docs/tutorial- Proposed difficulty
- 3 / 5
Proposed verifier
Grader checks via system state that httpd is enabled+running, firewalld http service is allowed, /var/www/app/index.php exists, and GET http://host returns the PHP output; Cockpit's Terminal page and SSH are disabled for the agent user, and the journal must attribute the changes to the cockpit-bridge web session.
Proposed partial credit
40% httpd enabled+running; 30% firewall rule; 30% vhost serves PHP
R03.04.01.04-T20 Clone and network a VM in virt-manager (control pair of T11)
Original instruction
Control pair of T11: using the virt-manager GUI on a libvirt host, clone the base domain 'alpine-base' to 'alpine-web', attach it to the isolated NAT network 'labnet', set 2 vCPUs and 1 GB RAM, boot it, and confirm it gets a DHCP lease. Perform all steps in the GUI.
- Platforms
lin· Linux- Applications
- virt-manager · QEMU
- Interfaces
desk· Desktop GUI- GUI need · task setting
G2· GUI-essential- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
click· Point & clicknav· Pan/zoom/scrollvis· Visual judgment- Work product
WP08· App/system state- Conditions
tutorial· Follow docs/tutorial- Proposed difficulty
- 2 / 5
Proposed verifier
virsh (grader side) shows domain alpine-web defined with 2 vCPUs, 1024MB, NIC on labnet; the domain is running and holds a DHCP lease on labnet; disk is a clone of the base volume (distinct backing file). The agent session has no terminal and virsh, virt-clone and virt-install are removed, so libvirt is reachable only through virt-manager.
Proposed partial credit
40% clone defined with correct CPU/RAM; 30% attached to labnet; 30% running with DHCP lease
Mapped research references
Existing benchmark-to-class links from the research catalog. They are not record-level annotations, executions or product endorsements.