Glossary

157 terms from IT Services Basics, in plain words, each with the chapter that teaches it.

Search the glossary

A

A record: The DNS record that gives a name's IP address. After an MX lookup, a sending mail server does an A lookup to find the mail server's address.
ACME (Automatic Certificate Management Environment): A protocol that lets servers renew their certificates automatically. Let's Encrypt and other CAs use it, which matters more as certificate lifetimes get shorter.
Active Directory (AD): Microsoft's domain system. A domain controller running it combines an LDAP directory, Kerberos sign-in, DNS and Group Policy.
active health checks: A load balancer such as HAProxy testing every server every few seconds, so it removes a dead server before customers reach it.
anonymous bind: Connecting to an LDAP directory without logging in, which is what ldapsearch -x does when you leave out -D. The server hides some attributes, such as userPassword, from anonymous searches.
Apache: One of the two most common web servers, next to nginx.
API (Application Programming Interface): A web service that programs call over HTTP, usually sending data as JSON. Kettle & Crane's app servers offer one to browsers, phone apps and café ordering scripts.
app stack: The usual three layers behind a website: clients, app servers that offer an API, and a database that only the apps talk to.
attributes: The named values stored in a directory entry, such as mail: priya@kettleandcrane.com or title: Customer Service.
Authentication: Proving who someone or something is. In TLS it means the client knows it is talking to the real shop.kettleandcrane.com and not an impostor.
authorized_keys: The file in an account's ~/.ssh folder that holds the public keys allowed to log in to it. SSH refuses it unless the folder is 700 and the file 600.

B

banner: The first line some services send as soon as you connect, naming the protocol, program and version, like SSH-2.0-OpenSSH_9.6p1. Anyone can read it, so it tells everyone what runs where.
base DN: The top of a directory tree, built from the domain name's parts, such as dc=kettleandcrane,dc=com. Searches start from it unless -b picks a lower point.
bind: Logging in to an LDAP directory. Many apps check a password by binding as the user: if the server accepts, the password is right.

C

certificate: A small file, signed by a certificate authority, that binds a public key to a name such as shop.kettleandcrane.com for a set period. Clients check its name, dates and chain before trusting a server.
certificate authority (CA): An organization that checks you really control a name and then signs your certificate. In the lab, Alex runs a private CA, as many companies do internally.
certificate signing request (CSR): A file asking a CA to sign a public key for a name ('please sign this key for shop.kettleandcrane.com'). openssl req -new makes one.
chain: The line of signatures from a site's certificate up through any intermediate CA to a trusted root. A server must send its intermediate, or clients report 'unable to get local issuer certificate'.
chrony: Ubuntu's NTP program. Its chronyd daemon keeps the clock right and can serve time to the office; chronyc asks it for its status.
client: The program that asks, such as Priya's web browser opening the order page. The program that answers is the server.
clock skew: A difference between two computers' clocks. Kerberos refuses sign-ins when it is over 5 minutes, which is one reason every device follows the office time server.
community string: The shared password used by SNMP versions 1 and 2c, such as kettle. It travels as plain text, so anyone capturing traffic can read it.
cookie: A small piece of data a server gives the browser, which sends it back with every later request to that site. It is how the shop knows a request for /account comes from Priya.
CUPS (Common UNIX Printing System): The Linux print server. It holds a queue for each printer and takes jobs over IPP on port 631.
curl: A command-line client for HTTP, HTTPS, IMAP and more. -v shows the whole conversation, -d sends form data with POST, -i shows response headers, -H adds a header, --cacert trusts a given CA, and -k turns certificate checks off (never use it as a fix).

D

daemon: The Linux name for a service running in the background. Its name often ends in d, like sshd, the SSH daemon.
database: The program that stores an app's data and finds it fast, queried with SQL. It should listen only on 127.0.0.1 or a private subnet, never on the internet.
DELETE: The HTTP method that removes a record, mostly used by APIs.
dig: A command-line DNS lookup tool that asks a DNS server for records and shows the answer. For example, `dig kettleandcrane.com MX +short` finds a domain's mail server, and it can also look up names and SRV records.
directory: One central database of people, groups and computers that every system asks. You add Priya once and remove her once.
distinguished name (DN): An entry's unique full name in a directory: the path from the entry up to the top, such as uid=priya,ou=people,dc=kettleandcrane,dc=com.
DKIM (DomainKeys Identified Mail): A digital signature the sending domain adds to each message, which receiving servers check with a public key published in DNS. With SPF and DMARC it helps catch forged senders.
DMARC (Domain-based Message Authentication, Reporting and Conformance): A DNS record that tells receiving servers what to do with mail that claims to come from a domain but fails its SPF and DKIM checks, and where to send reports.
DNS (Domain Name System): The internet's name lookup system, which turns names like orders.kettleandcrane.com into addresses (port 53). It also tells mail servers where to deliver (MX) and laptops where the domain controller is (SRV).
domain: A group of computers and users managed together by domain controllers. When Priya signs in to a domain-joined laptop, the laptop asks the DC.
domain controller (DC): The server that runs a Windows domain. It combines a directory, Kerberos, DNS and Group Policy, and offices usually run two.
Dovecot: A widely used IMAP (and POP3) server for Linux. It lets mail clients, such as Priya's, sign in and read the mailboxes on a mail server.

E

EHLO: The SMTP greeting in which the client gives its name. The server replies with a list of what it supports, such as STARTTLS.
Encryption: Scrambling data so that only the two ends can read it and an eavesdropper sees noise. It is one of the three things TLS gives a connection.
envelope: The SMTP sender and recipients given with MAIL FROM and RCPT TO, like the addresses on a paper envelope. Nothing forces them to match the message's own From: and To: headers, which is how senders get forged.

F

facility: The part of a syslog message that says which kind of program sent it, such as auth or mail. local0 to local7 are free for your own use.
file permissions: The access rights stored on files and folders themselves: owner, group and other bits on Linux, NTFS permissions on Windows. A share user gets only what both these and the share permissions allow.
filter: The condition in brackets that an LDAP search matches, such as (uid=priya). Filters can use * as a wildcard and combine with & (and), | (or) and ! (not).
forward proxy: A proxy that acts for users: staff browsers send their web traffic through it, so the office can filter and log browsing. It is the opposite of a reverse proxy.

G

GET: The HTTP method that asks for something, such as a page, picture or file. It has no body.
group Managed Service Account (gMSA): An AD service account whose long random password the domain controller creates and changes every 30 days. Only the servers you name may fetch it, and nobody types or sees it.
Group Policy: Settings the domain controller pushes to every computer and user in the domain, such as locking the screen after 10 minutes.
Group Policy Object (GPO): A named bundle of Group Policy settings stored on the DC. When linked to the domain or an OU, computers and users apply it at startup, at sign-in and about every 90 minutes.

H

HAProxy: A dedicated load balancer that can run active health checks on its servers.
header: A Name: value line that describes an HTTP or email message, such as Host or Content-Type. The headers end at the first empty line.
Host header: The HTTP request header that names the site, because one server can host many sites.
HTTP (Hypertext Transfer Protocol): The protocol of the web, on port 80. The client sends a request and the server sends one response, each with a start line, headers, an empty line and a body.
HTTP status codes: The three-digit result in an HTTP response's first line; the first digit says who must act: 2xx success, 3xx look elsewhere, 4xx the client's mistake, 5xx the server's fault. Common ones: 200 OK; 301 moved for good and 302 moved for now (the Location header says where); 400 bad request; 401 log in first; 403 forbidden; 404 not found; 500 the app crashed; 502 Bad Gateway and 503, a server behind a proxy failed; 504 Gateway Time-out, the app behind a proxy is too slow.
HTTPS (HTTP Secure): HTTP inside TLS, on port 443, with the same requests, headers, status codes and cookies. Logins such as Priya's must use it.

I

IIS (Internet Information Services): Microsoft's web server for Windows servers.
IMAP (Internet Message Access Protocol): The protocol for reading mail kept on the server, so every device sees the same folders. It uses port 143, or 993 with TLS.
Integrity: Being sure data wasn't changed on the way. With TLS, any change in transit is detected and the connection is dropped.

J

JSON (JavaScript Object Notation): The text format API data usually travels in, such as {"id": 1042, "qty": 2}.
jump host: One hardened server that admins log in to first, and the only machine allowed to reach the private servers behind it. There is one door to guard and one log to read.

K

Kerberos: The sign-in system of Windows domains, on port 88. It checks Priya's password once, gives her a ticket-granting ticket and then service tickets, so she never retypes the password.
Key Distribution Center (KDC): The Kerberos service on a domain controller. It checks sign-ins and hands out TGTs and service tickets.
key pair: A public key and a private key made together. The public key can check what the private key did but can't be used to work out the private key. TLS and SSH both use key pairs.
kinit: The Kerberos command that signs in as a user and gets a ticket-granting ticket, such as kinit priya.
klist: Lists the Kerberos tickets you hold, with their principal, start and expiry times. It works on Windows too.
known_hosts: The file where the SSH client remembers each server's key. If a key later changes, SSH warns and refuses to connect.

L

LDAP (Lightweight Directory Access Protocol): The protocol for searching and changing directories, on port 389 (636 with TLS). OpenLDAP and Active Directory both speak it.
ldapsearch: Searches a directory with a base, a filter and a list of attributes. -x uses a simple login instead of SASL, -LLL drops comment lines and -b sets where to start.
LDIF (LDAP Data Interchange Format): The text format for directory entries: a dn: line, one attribute per line, and an empty line between entries.
Let's Encrypt: A free certificate authority that uses ACME, so servers can renew their certificates automatically.
load balancer: A server that shares requests between several servers, as nginx does with Kettle & Crane's two app servers, so the site survives one of them failing.
location block: An nginx block that handles requests whose path starts a certain way, such as location /orders/, which passes them to the app servers.

M

mail client: The program a person reads and writes mail with, such as Outlook. Jo's mail client submits mail with SMTP, and Priya's fetches it with IMAP.
mail transfer agent (MTA): A server program that passes mail on to other servers, such as Postfix on Linux or Exchange on Windows.
method: The first word of an HTTP request, saying what the client wants: GET, POST, PUT or DELETE.
mount: The Linux command that attaches a shared folder to a local folder, for example an NFS share with mount -t nfs.
MX record (mail exchanger record): The DNS record naming a domain's mail server, with a preference number (lower is tried first). Bloom Café's server looks it up to find where mail for kettleandcrane.com goes.

N

nc (netcat): A tool that opens a TCP (or with -u, UDP) connection and passes text through, so you can talk to plain-text services by hand. -z tests a port without sending data, -v reports and -w sets a timeout.
NFS (Network File System): The way Linux and Unix servers share files with each other, on port 2049.
nginx: A common web server and reverse proxy (say 'engine-x'). It is configured with directives in nginx.conf, and Kettle & Crane uses it to serve the shop and balance two app servers.
NTFS permissions: The file permissions of Windows. A common practice is to give staff Full control on the share and control access with NTFS permissions.
NTP (Network Time Protocol): The protocol that sets clocks over the network, on UDP 123, through levels called strata. Kerberos, certificates, sign-in codes and log investigations all need correct time.

O

object classes: Labels on a directory entry that say what kind of thing it is and which attributes it must and may have, such as inetOrgPerson or groupOfNames.
OID (object identifier): The number path that names a value in SNMP's worldwide tree, such as 1.3.6.1.2.1.1.5.0 for a device's name.
open relay: A mail server that relays anyone's mail anywhere. Spammers find these within hours, which is why Postfix answers 'Relay access denied' to outsiders.
OpenLDAP: The usual LDAP directory server on Linux. Its server program is slapd.
openssl: The toolkit for keys and certificates. openssl req makes keys and signing requests, and openssl x509 signs and reads certificates (-checkend tells whether one expires soon).
openssl s_client: Connects to a TLS service on any port and prints its certificate and TLS version. servicemap.sh uses it to fetch the shop's certificate.
organizational unit (OU): A folder in a directory tree, such as ou=people or OU=Shipping. GPOs can be linked to one.

P

passive health check: A load balancer learning a server is down from failed requests. nginx does this, retrying on app 2 and skipping app 1 for a while.
POP3 (Post Office Protocol version 3): An older protocol that downloads mail to one device, usually deleting it from the server. It uses port 110, or 995 with TLS.
POST: The HTTP method that sends data such as a form, login or order in the body. curl -d makes a POST.
Postfix: A widely used mail transfer agent (MTA) for Linux. It accepts mail over SMTP, relays it to other servers and delivers it to local mailboxes.
principal: Kerberos's name for an account or service, such as priya@AD.KETTLEANDCRANE.COM.
print server: A server that holds a queue for each printer: laptops send jobs to it, and it feeds the printer. CUPS is one on Linux.
private key: The secret half of a key pair. It stays on the server (shop.key) or Alex's laptop (alex_key) and proves who holds it.
protocol: The agreed rules two programs use to talk: who speaks first, what words mean and how a message ends. Examples are HTTP for the web, SMTP for email and SSH for remote logins.
proxy_pass: The nginx directive that hands requests to another server or upstream group, such as proxy_pass http://orders_app.
public key: The half of a key pair anyone may see. It goes inside a certificate for TLS, or into authorized_keys for SSH.
PUT: The HTTP method that replaces a record, mostly used by APIs.

Q

query string: The part of a URL after ?, giving the server extra details, such as ?q=decaf. & joins several pairs.

R

raw printing: Sending print jobs straight to a printer on port 9100, with no login. This is why the label printer sits in the shop subnet, away from guests.
RDP (Remote Desktop Protocol): Shows a Windows computer's desktop in a window, on port 3389. You connect with the Remote Desktop app (mstsc), and it should never be exposed directly to the internet.
realm: The Kerberos name of a domain, written in capitals, such as AD.KETTLEANDCRANE.COM.
relative distinguished name (RDN): The first part of a DN, naming the entry itself, such as uid=priya.
relay: Passing mail from one server to another, with SMTP on port 25, as when Bloom Café's server hands Jo's message to Kettle & Crane's.
request and response: The two halves of every HTTP exchange: the client sends one request and the server sends one response. Each has a start line (method, path and version in a request; version, status code and phrase in a response), headers, an empty line and a body.
reverse proxy: A server in front of other servers that takes every client request and passes it to the right one behind it. It gives one front door, TLS termination, hidden apps and load balancing.
root: A CA certificate signed by itself, trusted only because it is in the trust store. The lab CA's certificate is one, so its subject and issuer are the same.
round robin: Sharing requests by taking the servers in turn. It is nginx's default, so requests alternate between app 1 and app 2.

S

Samba: Linux software that runs SMB file servers and can act as an Active Directory domain controller, so you don't need Windows Server.
scheme: The first part of a URL, naming the protocol to use, such as http or https. It also sets the default port (80 or 443).
server: The program that answers requests, such as the web server on the order machine. The machine it runs on is also called the server.
service: A server program that starts at boot, runs in the background and waits on a port for requests, like sshd on port 22.
service account: An account used by a program, such as backup software, not a person. Its password is a risk because it is often set once and never changed.
service ticket: A Kerberos ticket for one service, such as a file share or the DC's LDAP. The laptop gets it by showing the TGT, with no password needed.
session token: A random value in a cookie that stands for a logged-in user. Whoever shows Priya's token is treated as Priya, so it must travel over HTTPS.
severity: How serious a syslog message is, from 0 (emerg) to 7 (debug). Lower numbers are more serious, and Alex alerts on err (3) or worse.
share: A folder offered over the network, such as orders on the Kettle & Crane file server.
share permissions: Who may use a share and whether they may change things, set in smb.conf with valid users and read only. They are checked before file permissions, and the stricter of the two wins.
simple bind: An LDAP login with a DN and a password (-D and -w). It sends the password as plain text unless you use LDAPS or StartTLS.
single sign-on (SSO): Staff sign in once and every app trusts that sign-in. One directory account checked by every app is the first step toward it.
SMB (Server Message Block): The file-sharing protocol of Windows and Macs, on port 445. Samba speaks it on Linux.
SMB1: The unsafe old SMB version, now switched off everywhere. That is why smbclient prints 'SMB1 disabled'.
smbclient: A command-line SMB client. -L lists a server's shares, -U logs in, and -c runs commands such as put, get and ls.
SMTP (Simple Mail Transfer Protocol): The plain-text protocol that sends and relays mail: port 587 for submission (with a login) and 25 between servers.
SNMP (Simple Network Management Protocol): The protocol a monitoring server uses to ask devices for numbers such as uptime and traffic counters, on UDP 161. Traps go to UDP 162.
SNMPv3: The SNMP version that adds user names, real authentication and encryption. Use it wherever you can instead of community strings.
SPF (Sender Policy Framework): A DNS record listing which mail servers may send mail for a domain, so receiving servers can catch forged senders. It works together with DKIM and DMARC.
SRV records: DNS records that say which host offers a service and on which port, with a priority and weight. Laptops find the domain controller through them, such as _kerberos._tcp.ad.kettleandcrane.com.
ss: Lists sockets. ss -tulnp shows the listening TCP and UDP ports and their programs, which is the real truth of what a server offers.
SSH (Secure Shell): The encrypted remote shell for Linux, Unix and network devices, on port 22. It sends a banner first and can log in with keys instead of passwords.
ssh -L: Opens an SSH tunnel: it listens on a local port and sends what arrives through SSH to an address as seen from the server. Alex uses it to reach web's private status page.
ssh-keygen: Makes an SSH key pair (-t sets the type, -f names the files). With -l it shows a key's fingerprint.
sshd: The SSH server program, the SSH daemon. On Ubuntu it needs the folder /run/sshd.
SSL (Secure Sockets Layer): TLS's older name, which still shows up in tools and error messages. SSL itself is switched off everywhere as unsafe.
StartTLS: A command that upgrades a plain connection to TLS on the same port, such as LDAP on 389 or SMTP after EHLO.
stateless: Keeping no memory between requests. HTTP is stateless, so the shop needs cookies to know a later request comes from Priya.
sticky sessions: Sending a client to the same server every time, so the server holding Priya's session token keeps getting her requests. In nginx, ip_hash does this.
Subject Alternative Name (SAN): The certificate field listing the names it is valid for, which browsers check against the URL. If the name isn't there, curl reports 'no alternative certificate subject name matches'.
submission: A mail client handing a message to its own mail server with SMTP on port 587, after logging in.
syslog: The standard format and protocol for log messages, sent on UDP 514. Each message has a facility and a severity, and devices send them to one central log server, where an attacker on a device can't delete the copies.
systemctl: The command for systemd, which starts Linux services. systemctl status ssh shows whether a service runs, and systemctl stop or reload controls it.

T

ticket-granting ticket (TGT): The Kerberos ticket Priya gets when she signs in, like a festival wristband. It buys service tickets without her password.
TLS (Transport Layer Security): The layer between TCP and an app protocol that gives encryption, integrity and authentication using certificates. HTTPS, IMAPS and LDAPS are plain HTTP, IMAP and LDAP wrapped in TLS.
TLS handshake: The opening TLS exchange: hellos, the server's certificate, the client's checks and agreeing on fresh keys. Only then does encrypted HTTP flow. curl -v shows it.
TLS termination: Decrypting TLS at a proxy in front of the apps. The proxy holds the certificate, so the apps can stay simple.
trap: An SNMP message a device sends on its own, for example when a link goes down, to the monitor's UDP port 162.
trust store: The list of CAs an operating system or browser trusts. The lab CA isn't in the laptop's, which is why curl needs --cacert.
tunnel: A connection carried inside another, such as web's private status page carried inside SSH with ssh -L.

U

UNC path (Universal Naming Convention path): A share's network address, written \\server\share, such as \\files\orders.
upstream: An nginx block that names a group of servers behind the proxy, such as orders_app with two app servers. proxy_pass hands requests to it.
URL (Uniform Resource Locator): A web address, made of a scheme, host, optional port, path and query string, such as http://shop.kettleandcrane.com:8080/search?q=decaf.

V

VNC (Virtual Network Computing): Remote screen sharing on any system, from port 5900 up, often used to help a user on their own screen. Many VNC servers don't encrypt, so keep it on a protected network.
VPN (virtual private network): A protected way into the office network. RDP, VNC and SSH should sit behind one or a jump host, never directly on the internet.

W

web server: A program such as nginx, Apache or IIS that serves files fast, handles thousands of connections, runs TLS and logs every request.

X

X-Forwarded-For: A header a reverse proxy adds with the client's real address. Behind a proxy, apps otherwise see only the proxy's address, such as 127.0.0.1.
X.509: The standard certificate format. openssl x509 signs and reads such certificates, and -x509 makes a finished certificate.