Linux Foundation LFCS Linux Foundation Certified System Administrator (LFCS) Exam Practice Test

Objective: Create a new virtual machine using the existing Ubuntu 22.04 disk image, allocate 1024 MiB of RAM, register the virtual machine with libvirt, and ensure virt-install exits without opening an interactive console.

The correct solution uses virt-install with the --import and --noautoconsole options. The --import option is essential because the task provides an existing operating system disk image rather than requesting a fresh installation.

Step 1: Connect to the correct Linux server.

The video specifies that this task must be completed on host lfcs00083.

From the candidate terminal, execute:

ssh lfcs00083

This connects to the virtualization host where the VM must be created.

All subsequent commands must be executed on this host.

Step 2: Verify that virtualization tools are available.

Check the virt-install utility:

virt-install --version

Check the virsh utility:

virsh --version

Also check the QEMU image-management utility:

qemu-img --version

These tools serve different purposes:

virt-install creates and configures virtual machines.

virsh manages and inspects virtual machines through libvirt.

qemu-img examines and manages virtual disk images.

The task states that libvirt must be used, so creating the VM directly with a standalone qemu-system command would not be the appropriate solution.

Step 3: Verify connectivity to the libvirt hypervisor.

Execute:

sudo virsh --connect qemu:///system list --all

virsh communicates with the libvirt virtualization manager.

--connect qemu:///system selects the system-wide QEMU/KVM connection.

list --all displays both running and stopped virtual machines.

An illustrative result is:

Id Name State

--------------------------------

1 existing-vm running

- test-vm shut off

The actual VM list will depend on the host.

If libvirt cannot be contacted, check the host's libvirt services and sockets:

sudo systemctl status libvirtd

Some systems use modular libvirt daemons such as virtqemud, so inspect the installed service arrangement rather than assuming libvirtd is always present.

Step 4: Check whether cool-moray already exists.

Execute:

sudo virsh --connect qemu:///system list --all

Look for a virtual machine named:

cool-moray

You can check directly:

sudo virsh --connect qemu:///system dominfo cool-moray

If libvirt reports that the domain does not exist, proceed.

If the domain already exists, inspect it before making changes. Do not delete or recreate an existing machine without establishing why it is present.

The --name option of virt-install requires a name unique to the target libvirt connection.

Step 5: Verify that the existing disk image is present.

The task specifies the exact disk image path:

/vms/cool-moray/jammy-server-cloudimg-amd64.img

Execute:

ls -lh /vms/cool-moray/jammy-server-cloudimg-amd64.img

If normal user permissions do not allow inspection:

sudo ls -lh /vms/cool-moray/jammy-server-cloudimg-amd64.img

The image must exist before creating the VM.

Do not create an empty virtual disk in its place. The requirement is to use the existing disk image.

Step 6: Inspect the existing virtual disk image.

Execute:

sudo qemu-img info /vms/cool-moray/jammy-server-cloudimg-amd64.img

An example of the resulting information is:

image: /vms/cool-moray/jammy-server-cloudimg-amd64.img

file format: qcow2

virtual size: 2 GiB

disk size: 650 MiB

These size values are illustrative.

qemu-img info identifies the image's format, virtual size, actual allocated storage, and any backing image relationship.

Ubuntu cloud images commonly use QCOW2, but verify the actual image format instead of assuming it from the .img extension.

The existing image must remain intact.

Step 7: Confirm the guest operating-system type.

The disk filename contains:

jammy-server-cloudimg-amd64.img

jammy refers to Ubuntu 22.04 LTS, and amd64 indicates the x86-64 architecture.

Check the installed OS profiles:

virt-install --osinfo list

To find Ubuntu 22.04 specifically:

virt-install --osinfo list | grep -i ubuntu22

If ubuntu22.04 is available, it can be selected using:

--osinfo ubuntu22.04

This provides appropriate guest operating-system metadata and configuration defaults.

If that profile is unavailable, the upstream Ubuntu cloud-image procedure supports using:

--osinfo generic

Do not install a new operating system or download a different disk image merely to complete the task.

Step 8: Create the virtual machine using virt-install.

Once the disk exists, the libvirt connection works and the Ubuntu profile is supported, execute:

sudo virt-install \

--connect qemu:///system \

--name cool-moray \

--memory 1024 \

--disk path=/vms/cool-moray/jammy-server-cloudimg-amd64.img \

--osinfo ubuntu22.04 \

--import \

--noautoconsole

This is the principal solution.

If ubuntu22.04 is not recognized by the installed libosinfo database, substitute --osinfo generic, following the official Ubuntu cloud-image instructions.

The command leaves CPU count, network configuration and other parameters at their supported defaults because the visible task does not prescribe specific values for them.

Step 9: Understand every parameter in the command.

Parameter

Explanation

sudo

Executes with administrative privileges

virt-install

Creates and defines a VM through libvirt

--connect qemu:///system

Targets the system-wide QEMU/KVM hypervisor

--name cool-moray

Assigns the required VM name

--memory 1024

Allocates 1024 MiB of guest memory

--disk path=...

Attaches the existing virtual disk image

--osinfo ubuntu22.04

Selects the Ubuntu 22.04 operating-system profile

--import

Boots an existing OS image without running an installer

--noautoconsole

Prevents automatic attachment to the guest console and allows the command to return

Three arguments are especially important.

--memory 1024

The task specifies memory of 1024 MB. The virt-install utility interprets this parameter in MiB.

Therefore:

--memory 1024

sets the guest's configured RAM to 1024 MiB, equivalent to 1 GiB.

--import

This tells virt-install to create the VM around an existing disk image and skip the operating-system installation process.

Without an appropriate installation method such as --import, virt-install may expect installation media or fail to determine how the guest should be created.

--noautoconsole

The task explicitly requires this flag.

It prevents virt-install from automatically connecting to the guest's graphical or text console. Official documentation states that it also allows virt-install to exit promptly rather than waiting on an interactive console session.

Step 10: Verify that the creation command succeeds.

When virt-install succeeds, it normally prints messages indicating that the VM has been created and the domain is being started.

An illustrative successful message could be:

Starting install...

Creating domain...

Domain creation completed.

Do not treat these example messages as an actual result from the video.

Immediately after the command completes, check the exit status:

echo $?

Expected successful exit status:

0

If the command fails, read the actual error before attempting it again.

Common failure conditions include an existing VM name, inaccessible image path, unsupported OS profile, missing virtualization support or an unavailable default network.

Step 11: Verify that the new virtual machine is registered.

Execute:

sudo virsh --connect qemu:///system list --all

The output should now contain:

cool-moray

For example:

Id Name State

---------------------------

2 cool-moray running

The domain ID and runtime state may differ.

This command verifies that libvirt recognizes the VM.

Step 12: Verify the virtual machine's assigned memory.

Execute:

sudo virsh --connect qemu:///system dominfo cool-moray

Inspect the memory information.

For a VM configured with 1024 MiB, an expected value is:

Max memory: 1048576 KiB

Calculation:

\[ 1024 \times 1024 = 1,048,576 \text{ KiB} \]

This confirms that libvirt has the required memory allocation.

Also verify the VM name and general status in the same output.

Step 13: Verify the attached virtual disk.

Execute:

sudo virsh --connect qemu:///system domblklist cool-moray --details

The output should identify a disk whose source is:

/vms/cool-moray/jammy-server-cloudimg-amd64.img

This verifies that the VM uses the exact existing image required by the task.

Do not confuse creating a new blank disk with attaching the existing disk. The latter is required.

Step 14: Inspect the VM's persistent configuration.

Execute:

sudo virsh --connect qemu:///system dumpxml cool-moray

This displays the libvirt domain definition in XML format.

Look for the guest name:

< name > cool-moray < /name >

Also inspect the memory setting and the disk source.

The relevant configuration should contain the equivalent of:

< memory unit='KiB' > 1048576 < /memory >

And a disk source referencing:

< source file='/vms/cool-moray/jammy-server-cloudimg-amd64.img'/ >

The actual XML may include additional attributes, devices, generated addresses and machine-specific settings.

Step 15: Verify the VM's runtime state.

Execute:

sudo virsh --connect qemu:///system domstate cool-moray

A successful initial launch should normally report:

running

If it reports shut off, investigate the reason:

sudo virsh --connect qemu:///system dominfo cool-moray

You can also inspect the appropriate libvirt/QEMU logs.

Importing a cloud image registers and starts a guest, but it does not automatically establish guest login credentials or configure cloud-init user data. Those operations are not requested by this task.

Step 16: Verify that virt-install has returned control to the terminal.

Because --noautoconsole was specified, the virt-install command should return to the shell after initiating VM creation.

For example, the terminal prompt should become available again:

candidate@lfcs00083:~$

The presence of the normal shell prompt indicates that the creation utility is no longer occupying the terminal.

This is separate from the VM's own runtime state: the virtual machine may continue running after virt-install exits.

Step 17: Perform final verification.

Execute:

sudo virsh --connect qemu:///system list --all

sudo virsh --connect qemu:///system dominfo cool-moray

sudo virsh --connect qemu:///system domblklist cool-moray --details

sudo virsh --connect qemu:///system domstate cool-moray

Confirm the following:

Requirement

Expected result

VM name

cool-moray

Existing disk image

/vms/cool-moray/jammy-server-cloudimg-amd64.img

Memory

1024 MiB

Installation method

Existing image imported

Mandatory option

--noautoconsole used

VM registration

Present in libvirt

VM initial startup

Successful

Terminal

Returns to shell after creation

Final Solution

The essential commands are:

# Connect to the designated server

ssh lfcs00083

# Verify the existing disk image

ls -lh /vms/cool-moray/jammy-server-cloudimg-amd64.img

# Inspect the image

sudo qemu-img info /vms/cool-moray/jammy-server-cloudimg-amd64.img

# Check the VM name is available

sudo virsh --connect qemu:///system list --all

# Confirm the guest OS profile exists

virt-install --osinfo list

# Create the VM

sudo virt-install \

--connect qemu:///system \

--name cool-moray \

--memory 1024 \

--disk path=/vms/cool-moray/jammy-server-cloudimg-amd64.img \

--osinfo ubuntu22.04 \

--import \

--noautoconsole

# Verify the new VM

sudo virsh --connect qemu:///system list --all

sudo virsh --connect qemu:///system dominfo cool-moray

sudo virsh --connect qemu:///system domblklist cool-moray --details

sudo virsh --connect qemu:///system domstate cool-moray

Technical Verification and References

The solution is based on the official virt-install, libvirt and Ubuntu cloud-image documentation.

Ubuntu virt-install(1) Manual — Describes the --memory, --disk, --import, --osinfo and --noautoconsole options.

libvirt virsh Command Reference — Documents VM inspection commands, including list, dominfo, domblklist and domstate.

Ubuntu — Launch QCOW Cloud Images Using libvirt — Provides a practical example of launching an existing Ubuntu cloud image with virt-install, --import and --noautoconsole.

Video verification finding: At approximately 28:30, the recording shows Question 7 and the required host lfcs00083. The candidate begins entering the SSH command but cancels it and moves to Question 8. The recording therefore does not demonstrate a successful VM creation. The solution above is independently documentation-validated, not confirmed as executed in that recording.

Expected result: A virtual machine named cool-moray is created and registered through libvirt using the existing Ubuntu image, with 1024 MiB RAM. The VM starts successfully, and virt-install exits without attaching to the VM's console.

Step 1: Connect to the correct Linux server.

The video specifies that this task must be performed on host lfcs00073.

From the candidate terminal, execute:

ssh candidate@lfcs00073

This establishes an SSH connection to the designated Linux server.

All subsequent configuration changes must be performed on this host.

Step 2: Verify that user jack exists.

Execute:

id jack

This displays the user's UID, primary group and supplementary groups.

An example of valid output is:

uid=1001(jack) gid=1001(jack) groups=1001(jack)

The numerical IDs may differ.

You can also verify the account through the system user database:

getent passwd jack

The task requires modifying SSH authentication, not creating or modifying the user account.

Do not execute passwd jack or change the user's existing password.

Step 3: Identify the OpenSSH daemon configuration file.

The primary OpenSSH server configuration file on Ubuntu is:

/etc/ssh/sshd_config

Additionally, OpenSSH may load configuration fragments from:

/etc/ssh/sshd_config.d/

Inspect the primary configuration file:

sudo cat /etc/ssh/sshd_config

Check whether additional configuration files exist:

sudo ls -la /etc/ssh/sshd_config.d/

The effective OpenSSH configuration may depend on directives in both locations.

Step 4: Identify the existing authentication settings.

Execute:

sudo grep -RniE \

'KbdInteractiveAuthentication|ChallengeResponseAuthentication|UsePAM|AuthenticationMethods|Match' \

/etc/ssh/sshd_config /etc/ssh/sshd_config.d/ 2 > /dev/null

This searches for authentication-related directives.

The most important directive is:

KbdInteractiveAuthentication

It controls whether the SSH daemon permits keyboard-interactive authentication.

Possible values:

Configuration

Meaning

KbdInteractiveAuthentication yes

Permits keyboard-interactive authentication

KbdInteractiveAuthentication no

Disables keyboard-interactive authentication

On Ubuntu 22.04, the packaged OpenSSH configuration commonly disables keyboard-interactive authentication globally while enabling PAM.

OpenSSH daemon configuration file

However, the task requires the method to be enabled specifically for jack, without changing other users' login ability.

Therefore, simply changing the global directive from no to yes is not the appropriate solution.

Step 5: Examine the effective configuration before changing anything.

Execute:

sudo sshd -T \

-C user=jack,host=localhost,addr=127.0.0.1

This displays the effective SSH daemon configuration for a connection matching user jack.

To filter the relevant settings:

sudo sshd -T \

-C user=jack,host=localhost,addr=127.0.0.1 \

| grep -E 'kbdinteractiveauthentication|usepam|authenticationmethods'

For example, an initial configuration might show:

kbdinteractiveauthentication no

usepam yes

authenticationmethods any

This is an illustrative output. The actual values must be checked on the server.

Also record the same settings for another existing user, such as candidate:

sudo sshd -T \

-C user=candidate,host=localhost,addr=127.0.0.1 \

| grep -E 'kbdinteractiveauthentication|usepam|authenticationmethods'

These baseline values will be useful when verifying that other users remain unaffected.

Step 6: Back up the existing OpenSSH configuration.

Before modifying the daemon configuration, execute:

sudo cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

cp copies the configuration file.

-a preserves ownership, permissions and other file metadata.

/etc/ssh/sshd_config.bak is the backup copy.

If a configuration error occurs, the original file can be restored.

Keep the existing SSH session open while making these changes.

Step 7: Edit the OpenSSH daemon configuration.

Open the configuration file:

sudo nano /etc/ssh/sshd_config

Alternatively, use Vim:

sudo vim /etc/ssh/sshd_config

Review any existing Match directives before adding the required configuration.

Step 8: Configure keyboard-interactive authentication specifically for jack.

Provided no earlier matching block takes precedence, append the following configuration at the end of /etc/ssh/sshd_config:

Match User jack

KbdInteractiveAuthentication yes

This is the central configuration required for the task.

Match User jack

The Match directive begins a conditional configuration section.

The User jack condition means that the directives inside this section apply to connections authenticating as jack.

KbdInteractiveAuthentication yes

This enables keyboard-interactive authentication for connections satisfying the preceding Match condition.

Other users do not match User jack, so they retain their existing global or user-specific settings.

OpenSSH's official documentation permits KbdInteractiveAuthentication inside a Match section.

OpenSSH daemon configuration file

Important: If the existing configuration already contains a matching Match User jack or Match All block setting this option, edit the appropriate existing rule instead. OpenSSH generally uses the first occurrence of a directive among satisfied Match blocks. Simply appending a later block may not override an earlier matching rule.

Step 9: Save the configuration file.

If using Nano:

Press Ctrl + O to save.

Press Enter to confirm.

Press Ctrl + X to exit.

If using Vim, press Esc, type :wq, and press Enter.

The modified file should contain the user-specific rule:

Match User jack

KbdInteractiveAuthentication yes

Do not add a global AllowUsers jack rule. That could prevent other users from logging in and would violate the task.

Step 10: Verify the PAM authentication setting.

Execute:

sudo sshd -T \

-C user=jack,host=localhost,addr=127.0.0.1 \

| grep usepam

For the normal Ubuntu PAM-based authentication setup, the expected configuration is:

usepam yes

UsePAM yes allows OpenSSH to use PAM for keyboard-interactive authentication.

On Ubuntu, this directive normally appears in the global configuration.

Do not place UsePAM inside the Match User jack block. It is not a valid Match-specific directive in the relevant OpenSSH configuration.

If PAM is globally disabled, investigate the existing authentication design before changing it. Enabling PAM globally could affect other users, contrary to the task's constraints.

Step 11: Validate the SSH configuration syntax.

Before reloading the daemon, execute:

sudo sshd -t

sshd is the OpenSSH server daemon.

-t validates the configuration and checks relevant server key requirements.

A successful validation normally produces no output and returns exit code 0.

Check the result:

echo $?

Expected:

0

If errors are displayed, correct them before proceeding.

Do not restart or reload SSH with an invalid configuration.

Step 12: Verify that keyboard-interactive authentication is enabled for jack.

Execute:

sudo sshd -T \

-C user=jack,host=localhost,addr=127.0.0.1 \

| grep kbdinteractiveauthentication

Expected output:

kbdinteractiveauthentication yes

This confirms the effective server configuration for the specified user and connection context.

Unlike simply inspecting the configuration file, sshd -T -C evaluates applicable Match rules.

OpenSSH daemon

Step 13: Confirm that other users' authentication settings have not changed.

Execute:

sudo sshd -T \

-C user=candidate,host=localhost,addr=127.0.0.1 \

| grep -E 'kbdinteractiveauthentication|usepam|authenticationmethods'

Compare the output with the baseline recorded in Step 5.

If the original configuration had keyboard-interactive authentication disabled for candidate, it should remain disabled.

For example:

kbdinteractiveauthentication no

usepam yes

authenticationmethods any

The important requirement is that other users retain their original effective authentication settings, not that every server necessarily produces these example values.

Also verify any existing AuthenticationMethods policy. If it requires a method sequence that excludes standalone keyboard-interactive authentication, simply enabling KbdInteractiveAuthentication may not permit a keyboard-interactive-only login. Any necessary adjustment must remain specific to jack.

Step 14: Reload the OpenSSH daemon.

After verifying the configuration, execute:

sudo systemctl reload ssh

On Ubuntu, the systemd service is normally named ssh.

Reloading causes the daemon to apply its updated configuration without unnecessarily terminating established SSH sessions.

Step 15: Verify the SSH service is operational.

Execute:

sudo systemctl status ssh --no-pager

Expected active status:

Active: active (running)

You can also execute:

systemctl is-active ssh

Expected:

active

Step 16: Test keyboard-interactive authentication for jack.

From a separate SSH session, execute:

ssh -o PreferredAuthentications=keyboard-interactive \

-o PubkeyAuthentication=no \

-o PasswordAuthentication=no \

jack@localhost

PreferredAuthentications=keyboard-interactive selects keyboard-interactive authentication.

PubkeyAuthentication=no prevents the client from authenticating using a public key.

PasswordAuthentication=no disables the separate SSH password authentication method, without disabling keyboard-interactive prompts.

jack@localhost attempts to connect as user jack.

If PAM supports the account and the user supplies the correct existing credentials, the server should permit keyboard-interactive authentication.

If the server uses a multi-factor AuthenticationMethods policy, adapt the test to that policy and confirm keyboard-interactive authentication is offered at the appropriate stage.

Do not modify jack's password to perform the test.

Step 17: Perform final configuration checks.

Execute:

sudo sshd -t

Verify the setting for jack:

sudo sshd -T \

-C user=jack,host=localhost,addr=127.0.0.1 \

| grep kbdinteractiveauthentication

Expected:

kbdinteractiveauthentication yes

Verify another user's setting:

sudo sshd -T \

-C user=candidate,host=localhost,addr=127.0.0.1 \

| grep kbdinteractiveauthentication

The value must remain consistent with that user's original configuration.

Finally:

systemctl is-active ssh

Expected:

active

Final Solution

1. Connect to the correct host.

ssh candidate@lfcs00073

2. Back up the SSH configuration.

sudo cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

3. Edit the configuration file.

sudo nano /etc/ssh/sshd_config

4. Add the required configuration at the appropriate location, after checking existing Match rules.

Match User jack

KbdInteractiveAuthentication yes

5. Validate the SSH configuration.

sudo sshd -t

6. Verify the effective setting for jack.

sudo sshd -T \

-C user=jack,host=localhost,addr=127.0.0.1 \

| grep kbdinteractiveauthentication

Expected:

kbdinteractiveauthentication yes

7. Reload the SSH daemon.

sudo systemctl reload ssh

8. Confirm that SSH remains active.

systemctl is-active ssh

Expected:

active

Technical Verification and References

The solution has been checked against the official OpenSSH documentation for Ubuntu.

Match User applies specified configuration directives to connections matching a particular username.

KbdInteractiveAuthentication controls whether keyboard-interactive authentication is permitted.

UsePAM enables PAM integration used for keyboard-interactive authentication on typical Ubuntu systems.

sshd -t validates server configuration syntax.

sshd -T -C evaluates effective configuration settings for a particular connection, including applicable Match sections.

Official references:

Ubuntu OpenSSH sshd_config(5)

Ubuntu OpenSSH sshd(8)

OpenSSH Configuration Reference

Expected result: Keyboard-interactive authentication is persistently permitted for user jack, without changing the user's password or altering other users' existing login settings. Successful end-to-end authentication must also be confirmed with a valid login test.

Objective: Configure, compile, and install the GNU software package already extracted into ~/bool, using its default build and installation settings.

The standard GNU build procedure consists of three main commands, executed in this exact order:

/configure

make

sudo make install

The official GNU Autoconf and Automake documentation confirms this sequence for packages using the GNU build system.

Step 1: Connect to the correct Linux server.

The task is associated with host lfcs00102.

From the candidate terminal, execute:

ssh lfcs00102

This establishes an SSH session with the server where the source-code package must be configured, compiled, and installed.

All subsequent commands must be executed on this host.

Step 2: Navigate to the software source directory.

Execute:

cd ~/bool

cd changes the working directory.

~ represents the current user's home directory.

bool is the directory containing the extracted software source code.

Verify the current directory:

pwd

Expected structure:

/home/candidate/bool

The actual home directory depends on the account used on the host.

Step 3: Inspect the extracted source files.

Execute:

ls -la

A GNU Autotools-based source package commonly contains files such as:

configure

Makefile.am

Makefile.in

configure.ac

README

INSTALL

src/

These are examples of commonly encountered files; the actual directory contents may differ.

The critical file for the first stage is:

configure

The task explicitly states that the package has already been unpacked and the required development tools are installed.

Therefore, there is no need to download another source archive, extract additional files, or install development packages.

Step 4: Verify that the configuration script exists.

Execute:

ls -l ./configure

Then check whether it is executable:

test -x ./configure

echo $?

Expected exit code:

0

If the file is readable but lacks execution permission, you can inspect its permissions:

stat -c '%A %a %n' ./configure

Before changing permissions, confirm that the file is the actual generated configuration script.

If necessary, a readable configure shell script can also be executed with:

sh ./configure

However, the normal and preferred invocation for this task is ./configure.

Step 5: Configure the software package using all default settings.

Execute:

/configure

This is the first essential command.

The configure script examines the system and prepares the source tree for compilation.

Typical checks include:

Operating system and processor architecture.

Available C compiler.

Compiler capabilities and flags.

Required libraries and header files.

Build utilities and dependencies.

Installation directory configuration.

Generation of Makefiles.

An illustrative output might include:

checking for gcc... gcc

checking whether the C compiler works... yes

checking for stdio.h... yes

checking for stdlib.h... yes

checking for make... make

configure: creating ./config.status

config.status: creating Makefile

The output will differ according to the source package.

Important: The task requires all default settings. Therefore, do not specify configuration arguments such as:

/configure --prefix=/opt/bool

or:

/configure --disable-shared

unless explicitly requested.

Using plain ./configure ensures that the package's own default configuration options are selected.

GNU Autoconf documents that the default installation prefix is commonly /usr/local, although packages can choose another default.

Step 6: Verify that configuration completed successfully.

Immediately after ./configure finishes, execute:

echo $?

Expected:

0

Exit status 0 indicates that the configuration script completed successfully.

Next, verify the generated Makefile:

ls -l Makefile

You can also check for the configuration status file:

ls -l config.status

For a standard Autoconf package, these files indicate that configuration generated the instructions required for compilation.

If configuration reports a missing dependency or another error, investigate that specific error before proceeding to the build stage.

Do not assume that configuration succeeded merely because some files were generated.

Step 7: Inspect the generated Makefile.

Execute:

ls -lh Makefile

The Makefile contains the instructions that GNU Make uses to build and install the software.

You can inspect the default installation prefix:

grep -E '^prefix[[:space:]]*=' Makefile

A typical result is:

prefix = /usr/local

This means that the package is configured to install files under /usr/local, unless it defines different destinations.

Common GNU installation directories include:

Directory

Typical purpose

/usr/local/bin

User executables

/usr/local/sbin

Administration executables

/usr/local/lib

Program libraries

/usr/local/include

Header files

/usr/local/share

Architecture-independent data

Do not modify the installation prefix because the task requires the default settings.

Step 8: Build the software package.

Execute the second essential command:

make

This instructs GNU Make to build the software using the generated Makefile.

During compilation, Make may perform operations such as:

Reading the Makefile.

Identifying source files and dependencies.

Invoking the compiler.

Compiling source files into object files.

Linking object files with required libraries.

Producing executable programs or library files.

For a package written in C, an illustrative compilation sequence may look like:

gcc -DHAVE_CONFIG_H -I. -c main.c -o main.o

gcc -DHAVE_CONFIG_H -I. -c util.c -o util.o

gcc -o program main.o util.o

These commands are examples. The actual compilation operations depend on the package.

GNU Make normally builds the default target when invoked without arguments. For standard GNU packages, this is equivalent to the all target.

Step 9: Understand why make should normally run without sudo.

The recommended command is:

make

Not:

sudo make

Building as the normal user is preferable because it avoids creating root-owned intermediate files inside the source directory.

Administrative privileges are generally necessary only when installing files into protected system directories.

Since the task states that all build dependencies are already installed, the compilation should not require additional package installation.

Step 10: Verify that compilation completed successfully.

Immediately after make finishes, execute:

echo $?

Expected output:

0

This confirms that the Make process returned a successful exit status.

If compilation fails, the terminal normally reports an error, such as:

make: *** [Makefile:150: all] Error 2

Such output indicates a failed build.

Investigate the preceding compiler or linker error before continuing.

Do not attempt to install a package that has not built successfully.

Step 11: Confirm the build target is up to date.

You can run:

make

again after a successful build.

If no source files have changed, Make may display:

make: Nothing to be done for 'all'.

Alternatively, it may run a small number of checks or other build commands.

This is expected behavior: Make determines which targets need rebuilding based on its rules and dependencies.

A second build is optional and does not replace checking the first command's exit status.

Step 12: Run the package tests if supported.

Many GNU software packages provide an optional test target:

make check

This runs tests defined by the package's build system.

The official GNU Automake documentation defines make check as the conventional test-suite target.

However, the task does not explicitly require running tests.

Therefore, this step is optional. Use it only if the package provides the target and running the tests is appropriate.

If tests are run, verify their outcome:

echo $?

Expected successful status:

0

Do not confuse make check with make install. Tests validate a build but do not necessarily install it.

Step 13: Install the compiled software package.

After a successful build, execute:

sudo make install

This is the third essential command.

sudo provides administrative privileges.

make executes the build system's specified target.

install invokes the Makefile's installation rules.

The command installs the compiled software into its configured destinations.

Depending on the package, installation may include:

Copying executable binaries.

Installing shared or static libraries.

Installing header files.

Installing documentation and manual pages.

Installing additional package data.

The installation location follows the settings selected during ./configure.

GNU Automake confirms that make install copies the required built files into their installation directories.

Step 14: Do not change the installation destination.

The task specifically requests the default configuration.

Therefore, avoid commands such as:

sudo make install prefix=/opt/custom

Also avoid reconfiguring the package using:

/configure --prefix=/opt/custom

These would change the normal installation destinations.

The appropriate installation command remains:

sudo make install

Step 15: Verify that installation completed successfully.

Immediately after sudo make install finishes, execute:

echo $?

Expected:

0

A zero exit code indicates that the installation target completed successfully.

If installation fails with a permissions error, verify whether administrative privileges were applied correctly and inspect the affected directory.

If a build or dependency error occurs during installation, resolve that error before treating the task as complete.

Step 16: Verify the installation destination.

Inspect the installation prefix recorded in the Makefile:

grep -E '^prefix[[:space:]]*=' Makefile

If the prefix is /usr/local, the installed files will typically be placed in appropriate directories beneath that prefix.

You can inspect standard executable locations:

ls -lt /usr/local/bin/

And, where appropriate:

ls -lt /usr/local/lib/

These commands can help identify newly installed files, but they are not conclusive on their own because other software may already exist in those directories.

For more precise verification, inspect the package's Makefile installation rules or any installation manifest it produces.

Step 17: Verify the installed executable if applicable.

If the package installs an executable, first determine its actual command name from the package's documentation or installation output.

Then execute:

command -v ACTUAL_EXECUTABLE_NAME

For example, if a package installs an executable called example-program:

command -v example-program

You can then check its version if that option is supported:

example-program --version

These commands are illustrative. The directory name bool does not prove that the installed executable is also named bool.

Do not invent an executable name when validating the installation.

Step 18: Run installation checks if the package supports them.

Some GNU packages provide the following target:

make installcheck

This runs checks against installed software rather than files within the build tree.

GNU Automake documents installcheck as an optional target for validating installed programs and libraries.

It is not mandatory for this question.

The task requires configuration, compilation and installation. A successful sudo make install operation satisfies the installation stage.

Step 19: Understand why the three commands must be executed in order.

Order

Command

Purpose

1

/configure

Detects the build environment and prepares Makefiles using default settings

2

make

Compiles and links the source code

3

sudo make install

Installs the built software into the configured system directories

Each stage depends on the preceding stage.

Running make before a successful configuration might fail because the necessary Makefile has not been generated.

Running make install without a successful build may also fail or cause the installation target to attempt compilation. That does not replace the explicitly required build step.

For the LFCS simulation, execute each required stage separately and verify success before continuing.

Step 20: Perform the final verification.

From the source directory:

cd ~/bool

Check the generated Makefile:

test -f Makefile & & echo "Makefile exists"

Check the configuration status file if the package uses Autoconf:

test -f config.status & & echo "Configuration completed"

Confirm the configured prefix:

grep -E '^prefix[[:space:]]*=' Makefile

Check that the build is up to date:

make

Finally, verify the installed files or executable using the actual package name and installation output.

A successful result must satisfy all requirements:

Requirement

Expected result

Correct host

lfcs00102

Source directory

~/bool

Configure with defaults

Successful

Build package

Successful

Install package

Successful

Custom configure options

None

Source extraction

Already completed

Dependency installation

Already completed

Final Solution

The complete essential command sequence is:

Copy commands

# Connect to the designated host

ssh lfcs00102

# Navigate to the extracted source package

cd ~/bool

# Inspect the source files

ls -la

ls -l ./configure

# Step 1: Configure with default settings

/configure

# Step 2: Build the software package

make

# Step 3: Install the built package

sudo make install

To verify the exit status of each stage reliably, use the following alternative, which stops if a required stage fails:

cd ~/bool || exit 1

/configure & &

make & &

sudo make install

This short sequence is appropriate when the provided tools and dependencies are already available, as specified in the task.

Technical Verification and References

The solution has been validated against the official GNU build-system documentation.

GNU Autoconf Manual — Explains the generated configure script and default configuration settings.

GNU Make Manual — Explains compilation using Makefiles and Make targets.

GNU Automake — Standard Targets — Documents make, make check, make install and make installcheck.

Expected result: The GNU software package located at ~/bool is successfully configured using its default settings, compiled using GNU Make, and installed through its Makefile's installation target.

Verification limitation: The prescribed sequence is supported by official GNU documentation. Whether the commands successfully complete on lfcs00102 must be confirmed from their actual terminal output and exit statuses; the supplied recording does not establish an independently tested successful installation.

Objective: Configure Linux iptables to perform destination-port redirection using the NAT table.

The recording suggests this intended behavior:

Incoming source

Original destination port

Redirected local port

172.16.123.0/28

TCP 80

TCP 9080

All other IPv4 sources

TCP 80

TCP 8080

The second destination, 9080, comes from the candidate's terminal commands, not the fully visible task diagram. It must therefore be treated as an inferred requirement.

A crucial technical issue is rule priority: the more specific subnet rule must be evaluated before the general port-80 rule. Otherwise, the general rule captures the subnet traffic first.

Step 1: Connect to the correct Linux server.

The recording specifies host lfcs00074.

Execute:

ssh candidate@lfcs00074

This connects to the designated host on which the firewall and NAT configuration must be performed.

Step 2: Verify that iptables is available.

Execute:

sudo iptables --version

This displays the iptables version and may indicate whether the system uses the nf_tables or legacy backend.

For example:

iptables v1.8.x (nf_tables)

The actual version depends on the installed environment.

Step 3: Inspect the existing NAT configuration.

Execute:

sudo iptables -t nat -L -n -v

-t nat selects the Network Address Translation table.

-L lists rules.

-n displays numerical IP addresses and port numbers.

-v provides verbose output, including packet and byte counters.

The NAT table contains chains including PREROUTING, OUTPUT, and POSTROUTING.

For incoming connections being redirected to local services, the relevant chain is normally PREROUTING.

Step 4: Display the PREROUTING rules with line numbers.

Execute:

sudo iptables -t nat -L PREROUTING -n -v --line-numbers

This displays the order in which incoming packets encounter the NAT rules.

Also execute:

sudo iptables -t nat -S PREROUTING

The second command displays the rules in a format similar to the commands used to configure them.

Check whether there are already rules that redirect TCP port 80.

Avoid creating duplicate or contradictory rules.

Step 5: Understand the required redirection mechanism.

The Linux REDIRECT target changes the destination of a matching packet so that it is delivered to the local machine, optionally changing its destination port.

For example:

sudo iptables -t nat -A PREROUTING \

-p tcp --dport 80 \

-j REDIRECT --to-ports 8080

This redirects incoming TCP connections originally targeting port 80 to local port 8080.

The official iptables-extensions(8) manual confirms that REDIRECT is supported in the NAT table's PREROUTING and OUTPUT chains.

Linux manual page

Step 6: Configure the source-specific rule first.

For the inferred special handling of subnet 172.16.123.0/28, execute:

sudo iptables -t nat -I PREROUTING 1 \

-s 172.16.123.0/28 \

-p tcp --dport 80 \

-j REDIRECT --to-ports 9080

Option

Purpose

-t nat

Selects the NAT table

-I PREROUTING 1

Inserts the rule at position 1

-s 172.16.123.0/28

Matches packets originating from that subnet

-p tcp

Matches TCP traffic

--dport 80

Matches original destination port 80

-j REDIRECT

Redirects the packet to the local machine

--to-ports 9080

Changes the destination port to 9080

The -I PREROUTING 1 option is important because it places the specific rule at the beginning of the chain, ahead of broader rules appended later.

Do not run this command if an equivalent correct rule already exists; inspect and reconcile the existing configuration first.

Step 7: Configure the general port redirection.

Provided an equivalent general rule is not already present, execute:

sudo iptables -t nat -A PREROUTING \

-p tcp --dport 80 \

-j REDIRECT --to-ports 8080

This handles incoming TCP port-80 connections that did not match an earlier terminating rule.

Because the source-specific rule has higher priority, the expected behavior is:

Connections from 172.16.123.0/28 are redirected to 9080.

Other incoming TCP port-80 connections are redirected to 8080.

The general rule does not require a source restriction because it is the fallback rule.

Step 8: Understand why the rule order matters.

The candidate initially enters the broad redirect to 8080 and later adds the subnet-specific redirect to 9080.

That sequence is problematic.

Consider these two rules in this order:

sudo iptables -t nat -A PREROUTING \

-p tcp --dport 80 \

-j REDIRECT --to-ports 8080

sudo iptables -t nat -A PREROUTING \

-s 172.16.123.0/28 \

-p tcp --dport 80 \

-j REDIRECT --to-ports 9080

The first rule matches all incoming TCP port-80 connections, including those from the special subnet.

Since a REDIRECT target terminates further rule evaluation for that NAT decision, the later subnet rule will not receive those matching connections.

Correct order:

Rule 1: Subnet 172.16.123.0/28 → Port 9080

Rule 2: Other TCP port-80 connections → Port 8080

The Linux iptables manual documents sequential rule evaluation and matching behavior.

Linux manual page

Step 9: Verify the configured NAT rules.

Execute:

sudo iptables -t nat -L PREROUTING \

-n -v --line-numbers

The relevant rule sequence should resemble:

1 REDIRECT tcp -- 172.16.123.0/28 0.0.0.0/0 tcp dpt:80 redir ports 9080

2 REDIRECT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 redir ports 8080

The output format may vary.

If existing unrelated rules are present, preserve them. The two example lines do not imply that the real NAT table should contain only two rules.

Step 10: Correct any incorrectly ordered rules.

If the general port-80 rule is already first, the specific rule can be inserted ahead of it using:

sudo iptables -t nat -I PREROUTING 1 \

-s 172.16.123.0/28 \

-p tcp --dport 80 \

-j REDIRECT --to-ports 9080

Before doing so, make sure an identical subnet rule is not already present.

If the previous candidate commands created duplicate entries, list the chain:

sudo iptables -t nat -L PREROUTING -n --line-numbers

Then carefully remove only confirmed duplicate or erroneous entries by their current rule number:

sudo iptables -t nat -D PREROUTING RULE_NUMBER

Replace RULE_NUMBER with the actual displayed number.

Rule numbers can change after each deletion, so inspect the chain again before deleting another entry.

Do not flush the entire NAT table.

Step 11: Verify that the destination services are available.

Execute:

sudo ss -ltnp

To examine the relevant ports:

sudo ss -ltnp | grep -E ':(8080|9080)\b'

This checks whether processes are listening on TCP ports 8080 and 9080.

The iptables rules may be syntactically correct even if no service is currently listening. However, actual connection delivery requires an appropriate local service and any necessary firewall permission.

A NAT redirection rule does not automatically start the destination application.

Step 12: Check whether filtering rules permit redirected connections.

Execute:

sudo iptables -L INPUT -n -v

Check whether the existing INPUT chain allows connections to the effective destination ports.

The REDIRECT target changes the packet's destination, but a restrictive filter policy can still block delivery.

Do not add broad ACCEPT rules unless the actual task requires them and the existing firewall policy warrants the change.

Step 13: Test traffic from the specified subnet.

From a machine whose source address belongs to:

172.16.123.0/28

Initiate a fresh TCP connection to port 80 on the appropriate IP address of lfcs00074.

For an HTTP-based service, a test could use:

curl -v http://SERVER_IP:80/

Replace SERVER_IP with the real server address.

If the inferred subnet-specific rule is correct, the connection should reach the local service listening on port 9080.

A destination service's response or a packet trace can establish which port received the connection.

Step 14: Test traffic from outside the specified subnet.

From a client outside 172.16.123.0/28, initiate another new connection to the same server's TCP port 80.

The general rule should redirect that traffic to port 8080, provided no earlier rule intercepts it.

Do not rely only on a test from:

curl http://localhost:80

Locally generated traffic traverses the NAT OUTPUT chain rather than the incoming PREROUTING chain. It is therefore not a valid test of these PREROUTING rules.

Step 15: Inspect rule counters.

Execute:

sudo iptables -t nat -L PREROUTING \

-n -v --line-numbers

Review the packet and byte counters.

New matching connections should increment the applicable rule's counters.

Because NAT decisions are generally made for the initial packets of tracked connections, established connections may not increment counters in the way ordinary filter-chain traffic does.

Use fresh connections for testing.

Step 16: Preserve the rules if persistence is required.

The video shows the candidate using:

sudo service netfilter-persistent save

For a system with the appropriate netfilter-persistent plugins installed, the documented command is:

sudo netfilter-persistent save

This saves the active firewall rules through the installed persistence plugins.

Ubuntu's netfilter-persistent(8) manual documents the save operation.

Ubuntu Manpages

Before relying on it, check that the service and IPv4 plugin are installed:

command -v netfilter-persistent

ls -l /usr/share/netfilter-persistent/plugins.d/

If persistence is required, verify the saved IPv4 rules:

sudo grep -A 20 '^\*nat' /etc/iptables/rules.v4

The saved configuration should contain the correctly ordered rules.

Persistence is not explicitly visible in the task statement, so treat it as an additional measure suggested by the recorded candidate actions, not a proven requirement.

Step 17: Perform final verification.

Execute:

sudo iptables -t nat -S PREROUTING

sudo iptables -t nat -L PREROUTING -n -v --line-numbers

sudo ss -ltnp | grep -E ':(8080|9080)\b'

For the inferred two-rule requirement, the expected configuration is:

Verification

Expected behavior

Source subnet

172.16.123.0/28

Original destination

TCP port 80

Special-subnet destination

TCP port 9080

General destination

TCP port 8080

Specific rule priority

Before general rule

NAT table

nat

NAT chain

PREROUTING

Existing unrelated rules

Preserved

Final Solution

For the two redirection paths inferred from the recording, and assuming equivalent rules do not already exist, the essential command sequence is:

# Connect to the required server

ssh candidate@lfcs00074

# Inspect existing NAT rules

sudo iptables -t nat -S PREROUTING

# Specific subnet: TCP 80 → 9080

# This rule must have higher priority.

sudo iptables -t nat -I PREROUTING 1 \

-s 172.16.123.0/28 \

-p tcp --dport 80 \

-j REDIRECT --to-ports 9080

# General traffic: TCP 80 → 8080

sudo iptables -t nat -A PREROUTING \

-p tcp --dport 80 \

-j REDIRECT --to-ports 8080

# Verify rule ordering and counters

sudo iptables -t nat -L PREROUTING \

-n -v --line-numbers

# If persistence is required and configured

sudo netfilter-persistent save

Technical Verification and References

Linux iptables(8)

— Documents rule insertion, ordering, matching and chain operations.

Linux iptables-extensions(8)

— Defines the REDIRECT target and --to-ports option.

Ubuntu netfilter-persistent(8)

— Documents saving and restoring firewall rules.

Video verification finding: The candidate's commands reveal an attempted redirect from port 80 to 8080 and a separate source-specific redirect from port 80 to 9080. The specific rule was appended after the general rule, which would prevent the special-subnet redirect from taking effect as intended. The corrected sequence places the specific rule first.

Verification limitation: The full task diagram is never visible, so the inferred two-rule interpretation cannot be certified as the exact complete exam requirement. The command syntax and priority correction are validated against Linux documentation, but the final intended behavior requires the missing diagram portion and runtime connection tests.

next please

Worked for 3m 12s

Objective: Correct the Linux system clock by performing a one-time synchronization against NTP servers from pool.ntp.org, without enabling continuous or automatic time synchronization and without modifying the hardware clock.

The video shows the candidate successfully executing:

sudo ntpdate pool.ntp.org

This is a valid solution. The terminal output confirms that the system clock was adjusted using an NTP server.

The official Ubuntu ntpdate(8) documentation confirms that ntpdate can synchronize the system clock manually without establishing an ongoing synchronization service.

Ubuntu Manpages

Step 1: Connect to the correct Linux server.

The video specifies host lfcs00103.

From the candidate terminal, execute:

ssh lfcs00103

This establishes an SSH session with the server whose system clock requires correction.

All subsequent commands must be executed on this host.

Step 2: Inspect the current system date and time.

Execute:

date

This displays the system's current local date and time.

For UTC:

date -u

The -u option displays the system time in Coordinated Universal Time.

Record the initial date and time so you can compare the system clock before and after synchronization.

The task states that the system clock has drifted. Therefore, its displayed time may differ significantly from the actual time reported by NTP servers.

Step 3: Check the current time synchronization status.

Execute:

timedatectl status

This displays information such as:

Local time.

Universal time.

RTC (hardware clock) time.

Configured timezone.

Whether an NTP synchronization service is active.

Whether the system reports its clock as synchronized.

An illustrative output is:

Local time: Sat 2026-10-03 11:30:00 UTC

Universal time: Sat 2026-10-03 11:30:00 UTC

RTC time: Sat 2026-10-03 11:30:00

Time zone: Etc/UTC (UTC, +0000)

System clock synchronized: no

NTP service: inactive

These values are illustrative rather than the actual output from the video.

Since the question asks for manual one-time synchronization, there is no need to configure an automatic NTP service.

Step 4: Verify that the ntpdate utility is available.

Execute:

command -v ntpdate

If installed, this command displays its executable path.

For example:

/usr/sbin/ntpdate

You can inspect the utility's manual:

man ntpdate

The task's demonstrated environment already has ntpdate available.

Therefore, installing additional software is unnecessary.

Step 5: Verify hostname resolution for the NTP server pool.

The task specifies:

pool.ntp.org

Check that the hostname resolves:

getent ahosts pool.ntp.org

This should return IP addresses associated with the NTP pool.

pool.ntp.org is a DNS-based collection of public NTP servers rather than one fixed machine.

Using the pool allows the time client to obtain available servers without manually specifying individual server addresses.

A successful synchronization also requires network connectivity to an NTP server, normally using UDP port 123.

Step 6: Check for an existing time synchronization daemon if necessary.

Execute:

systemctl is-active systemd-timesyncd

systemctl is-active chrony

systemctl is-active ntp

Some services may not be installed, so an inactive, unknown, or unit-not-found result is possible.

The task says not to configure automatic synchronization. It does not require enabling any of these services.

If an existing synchronization daemon interferes with a one-time adjustment, investigate and handle that conflict without unnecessarily modifying its persistent configuration.

Do not enable a daemon merely to synchronize the clock once.

Step 7: Synchronize the system clock manually using ntpdate.

Execute the primary solution:

sudo ntpdate pool.ntp.org

This is the command demonstrated in the video.

Command component

Purpose

sudo

Grants privileges to modify the system clock

ntpdate

Queries NTP servers and adjusts the local system clock

pool.ntp.org

Specifies the requested NTP server pool

The utility contacts NTP servers, estimates the difference between the local clock and server time, and corrects the local clock.

Depending on the implementation and magnitude of the error, it may step or slew the clock.

A step changes the displayed system time immediately. A slew changes the clock gradually.

The ntpdate manual documents the clock-setting behavior and the difference between querying and updating the clock.

Ubuntu Manpages

Step 8: Examine the synchronization output.

The recording shows that the ntpdate command corrected a substantial clock error.

The terminal includes a successful adjustment message of the form:

CLOCK: time stepped by 37212257.308748

It also reports that the system clock moved from an incorrect date in July 2025 to October 3, 2026.

This is significant because it confirms that the command did more than merely query an NTP server: it actually changed the system clock.

Your terminal output will depend on the clock's actual drift when the command runs.

A small drift may result in a different adjustment message.

Step 9: Verify the command's exit status.

Immediately after the synchronization command completes, execute:

echo $?

Expected:

0

The official ntpdate documentation specifies that a zero exit status indicates a successful clock update.

Ubuntu Manpages

A nonzero status indicates that the operation failed.

If the operation fails, investigate the actual error rather than assuming that the clock has been corrected.

Possible issues include unavailable DNS resolution, unreachable NTP servers, firewall restrictions, or interference from another time synchronization process.

Step 10: Verify the corrected system time.

Execute:

date

Then:

date -u

These commands display the system time after the NTP adjustment.

Compare the new values with the values recorded before synchronization.

The corrected clock should be consistent with the time reported by the selected NTP servers.

Step 11: Optionally check the remaining time offset without changing the clock.

Execute:

sudo ntpdate -q pool.ntp.org

The -q option means query only.

It obtains time information and reports the estimated offset without setting the clock.

This is useful after synchronization because it allows you to check whether the remaining clock difference is small.

Do not confuse:

sudo ntpdate -q pool.ntp.org

with:

sudo ntpdate pool.ntp.org

The first command queries only; the second performs the requested clock adjustment.

A small reported offset provides supporting evidence that the local clock is close to the NTP reference time.

Step 12: Do not configure automatic synchronization.

The task explicitly states:

Do not configure automatic time synchronization.

Therefore, do not enable a continuous time synchronization service as part of the solution.

For example, avoid:

sudo timedatectl set-ntp true

Also avoid enabling a daemon solely for this task:

sudo systemctl enable --now chrony

Likewise, do not create a cron job that runs ntpdate periodically.

These operations would establish ongoing synchronization behavior rather than performing the required one-time adjustment.

The command:

sudo ntpdate pool.ntp.org

already satisfies the one-time synchronization requirement when it completes successfully.

Step 13: Do not manually update the hardware clock.

Linux maintains two conceptually distinct clocks:

Clock

Description

System clock

Kernel-maintained clock used by running applications

Hardware clock (RTC)

Battery-backed or virtualized real-time clock used across system restarts

The task specifically instructs that the hardware clock does not need to be updated.

Therefore, do not execute:

sudo hwclock --systohc

This command copies the system clock to the hardware clock and is unnecessary for the task.

The exam environment is already configured to perform the appropriate hardware-clock update during shutdown.

Step 14: Do not modify persistent NTP configuration files.

The task does not require editing files such as:

/etc/chrony/chrony.conf

/etc/systemd/timesyncd.conf

/etc/ntp.conf

These files belong to time synchronization service configurations and are unrelated to the required manual one-time operation.

There is also no requirement to change the timezone.

Step 15: Verify the system status after synchronization.

Execute:

timedatectl status

Inspect the system time.

One important technical detail: after a manual ntpdate adjustment, timedatectl may still report:

System clock synchronized: no

This does not necessarily mean the one-time NTP adjustment failed.

That status may depend on whether a running time synchronization service or the kernel's synchronization status has marked the clock as synchronized.

For this task, rely primarily on the successful ntpdate execution, the resulting clock adjustment, and an optional read-only NTP offset check.

Do not enable automatic synchronization simply to change the timedatectl status.

Step 16: Alternative solution if ntpdate is unavailable.

If the host provides Chrony instead of ntpdate, the officially documented one-time synchronization command is:

sudo chronyd -q 'pool pool.ntp.org iburst'

chronyd is Chrony's time synchronization program.

-q instructs it to set the system clock once and exit.

pool pool.ntp.org selects servers from the specified NTP pool.

iburst performs an initial burst of requests for quicker synchronization.

This is the alternative recommended by Ubuntu's current time synchronization documentation.

Frequently Asked Questions

+1

Use this alternative only if appropriate for the installed environment. If another Chrony daemon is already running, avoid launching a competing clock controller without resolving that conflict.

For the environment demonstrated in the supplied video, ntpdate is available and is the simpler, directly demonstrated solution.

Step 17: Perform final verification.

Execute:

date -u

Confirm the corrected system time.

If needed, check the NTP offset without changing the clock:

sudo ntpdate -q pool.ntp.org

The completed task should satisfy:

Requirement

Expected result

Correct host

lfcs00103

NTP server pool

pool.ntp.org

System clock synchronized once

Yes

Method

Manual NTP adjustment

Automatic synchronization configured

No

Hardware clock manually changed

No

Clock adjustment

Successful

Final Solution

The essential commands are:

# Connect to the designated server

ssh lfcs00103

# Check the current system time

date -u

# Perform one-time synchronization

sudo ntpdate pool.ntp.org

# Verify the corrected time

date -u

# Optional: query the remaining offset without modifying the clock

sudo ntpdate -q pool.ntp.org

The single command that performs the requested adjustment is:

sudo ntpdate pool.ntp.org

Technical Verification and References

Ubuntu ntpdate(8) Manual

— Documents one-time clock synchronization, query-only mode and exit status.

Chrony Official FAQ

— Documents chronyd -q for one-time clock synchronization.

Ubuntu Server — Time Synchronization

— Explains NTP, Chrony and one-shot synchronization.

Video verification finding: At approximately 30:30–30:46, the candidate connects to lfcs00103 and executes sudo ntpdate pool.ntp.org. The terminal displays a successful clock-step operation, correcting a large time difference. No continuous synchronization service or hardware-clock modification is shown.

Expected result: The system clock on lfcs00103 is corrected through a single NTP synchronization against pool.ntp.org. No automatic time synchronization is configured, and the hardware clock is left unchanged.

next batch now