Format

• written questions
• practical configuration task
• review of a risky SSH scenario
• short operations and security assessment

Expected Answer Profile

A good answer explains trust, authentication, file and agent risks with concrete commands, fingerprints and configuration excerpts.

Questions

Solution 01

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for explain SSH protocol layers.

Solution 02

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for distinguish OpenSSH client and server.

Solution 03

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for verify host-key trust.

Solution 04

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for generate and protect user keys.

Solution 05

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for review permissions for .ssh``.

Solution 06

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for debug public-key authentication.

Solution 07

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for structure ssh_config with Host blocks.

Solution 08

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for review sshd_config safely.

Solution 09

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for design ProxyJump and bastion paths.

Solution 10

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for control port forwarding.

Solution 11

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for classify SFTP and safe file transfer.

Solution 12

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for use ssh-agent safely.

Solution 13

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for justify or reject agent forwarding.

Solution 14

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for model OpenSSH certificates and CA trust.

Solution 15

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for explain KRL and revocation.

Solution 16

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for classify FIDO2 keys.

Solution 17

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for analyze logging and auth events.

Solution 18

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for weigh hardening options.

Solution 19

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for run incident response for key leakage.

Solution 20

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for test client and server configuration.

Solution 21

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for plan recovery for host-key rotation.

Solution 22

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for explain SSH protocol layers.

Solution 23

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for distinguish OpenSSH client and server.

Solution 24

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for verify host-key trust.

Solution 25

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for generate and protect user keys.

Solution 26

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for review permissions for .ssh``.

Solution 27

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for debug public-key authentication.

Solution 28

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for structure ssh_config with Host blocks.

Solution 29

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for review sshd_config safely.

Solution 30

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for design ProxyJump and bastion paths.

Solution 31

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for control port forwarding.

Solution 32

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for classify SFTP and safe file transfer.

Solution 33

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for use ssh-agent safely.

Solution 34

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for justify or reject agent forwarding.

Solution 35

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for model OpenSSH certificates and CA trust.

Solution 36

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for explain KRL and revocation.

Solution 37

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for classify FIDO2 keys.

Solution 38

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for analyze logging and auth events.

Solution 39

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for weigh hardening options.

Solution 40

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for run incident response for key leakage.

Solution 41

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for test client and server configuration.

Solution 42

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for plan recovery for host-key rotation.

Solution 43

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for explain SSH protocol layers.

Solution 44

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for distinguish OpenSSH client and server.

Solution 45

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for verify host-key trust.

Solution 46

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for generate and protect user keys.

Solution 47

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for review permissions for .ssh``.

Solution 48

Expected: name host-key trust, identify affected user and key, classify client or server option, explain risk and provide concrete evidence for debug public-key authentication.

Practical Task

Create an SSH client configuration with bastion alias, IdentityFile, known-hosts file and controlled forwarding. Add a hardening review for a server-side sample configuration.

Review Checklist for Fundamentals

• 01. document host-key trust: Record the affected host, user, key, configuration and risk.
• 02. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
• 03. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
• 04. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
• 05. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
• 06. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
• 07. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
• 08. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
• 09. keep certificate validity short: Record the affected host, user, key, configuration and risk.
• 10. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
• 11. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
• 12. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
• 13. document host-key trust: Record the affected host, user, key, configuration and risk.
• 14. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
• 15. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
• 16. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
• 17. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
• 18. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
• 19. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
• 20. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
• 21. keep certificate validity short: Record the affected host, user, key, configuration and risk.
• 22. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
• 23. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
• 24. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
• 25. document host-key trust: Record the affected host, user, key, configuration and risk.
• 26. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
• 27. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
• 28. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
• 29. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
• 30. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
• 31. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
• 32. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
• 33. keep certificate validity short: Record the affected host, user, key, configuration and risk.
• 34. plan KRL or rotation for revocation: Record the affected host, user, key, configuration and risk.
• 35. store logs and fingerprints as evidence: Record the affected host, user, key, configuration and risk.
• 36. test changes with a test configuration first: Record the affected host, user, key, configuration and risk.
• 37. document host-key trust: Record the affected host, user, key, configuration and risk.
• 38. exclude private keys from the repository: Record the affected host, user, key, configuration and risk.
• 39. check permissions for keys and .ssh: Record the affected host, user, key, configuration and risk.
• 40. justify or disable password login and root login: Record the affected host, user, key, configuration and risk.
• 41. allow agent forwarding only with risk acceptance: Record the affected host, user, key, configuration and risk.
• 42. prefer ProxyJump over copying keys onto bastions: Record the affected host, user, key, configuration and risk.
• 43. limit port forwarding to need and bind address: Record the affected host, user, key, configuration and risk.
• 44. use authorized_keys options for special access: Record the affected host, user, key, configuration and risk.
• 45. keep certificate validity short: Record the affected host, user, key, configuration and risk.

Practice Appendix: Fundamentals

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with OpenSSH client tools, test keys and sample configurations.

A001. SSH

• Task: verify fingerprint and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A002. Review

• Task: evaluate configuration and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A003. Trust

• Task: justify risk and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A004. Security

• Task: explain error path and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A005. SSH

• Task: classify log line and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A006. Review

• Task: document trust model and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A007. Trust

• Task: plan rotation and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A008. Security

• Task: restrict access and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A009. SSH

• Task: review forwarding and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A010. Review

• Task: describe recovery path and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A011. Trust

• Task: verify fingerprint and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A012. Security

• Task: evaluate configuration and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A013. SSH

• Task: justify risk and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A014. Review

• Task: explain error path and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A015. Trust

• Task: classify log line and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A016. Security

• Task: document trust model and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A017. SSH

• Task: plan rotation and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A018. Review

• Task: restrict access and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A019. Trust

• Task: review forwarding and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A020. Security

• Task: describe recovery path and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A021. SSH

• Task: verify fingerprint and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A022. Review

• Task: evaluate configuration and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A023. Trust

• Task: justify risk and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A024. Security

• Task: explain error path and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A025. SSH

• Task: classify log line and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A026. Review

• Task: document trust model and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A027. Trust

• Task: plan rotation and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A028. Security

• Task: restrict access and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A029. SSH

• Task: review forwarding and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A030. Review

• Task: describe recovery path and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A031. Trust

• Task: verify fingerprint and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A032. Security

• Task: evaluate configuration and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A033. SSH

• Task: justify risk and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A034. Review

• Task: explain error path and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A035. Trust

• Task: classify log line and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A036. Security

• Task: document trust model and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A037. SSH

• Task: plan rotation and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A038. Review

• Task: restrict access and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A039. Trust

• Task: review forwarding and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A040. Security

• Task: describe recovery path and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A041. SSH

• Task: verify fingerprint and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A042. Review

• Task: evaluate configuration and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A043. Trust

• Task: justify risk and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A044. Security

• Task: explain error path and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A045. SSH

• Task: classify log line and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A046. Review

• Task: document trust model and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A047. Trust

• Task: plan rotation and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A048. Security

• Task: restrict access and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A049. SSH

• Task: review forwarding and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A050. Review

• Task: describe recovery path and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A051. Trust

• Task: verify fingerprint and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A052. Security

• Task: evaluate configuration and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A053. SSH

• Task: justify risk and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A054. Review

• Task: explain error path and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A055. Trust

• Task: classify log line and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A056. Security

• Task: document trust model and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A057. SSH

• Task: plan rotation and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A058. Review

• Task: restrict access and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A059. Trust

• Task: review forwarding and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A060. Security

• Task: describe recovery path and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A061. SSH

• Task: verify fingerprint and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A062. Review

• Task: evaluate configuration and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A063. Trust

• Task: justify risk and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A064. Security

• Task: explain error path and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A065. SSH

• Task: classify log line and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A066. Review

• Task: document trust model and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A067. Trust

• Task: plan rotation and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A068. Security

• Task: restrict access and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A069. SSH

• Task: review forwarding and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A070. Review

• Task: describe recovery path and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A071. Trust

• Task: verify fingerprint and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A072. Security

• Task: evaluate configuration and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A073. SSH

• Task: justify risk and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A074. Review

• Task: explain error path and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A075. Trust

• Task: classify log line and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A076. Security

• Task: document trust model and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A077. SSH

• Task: plan rotation and connect the observation explicitly to SSH.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A078. Review

• Task: restrict access and connect the observation explicitly to Review.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A079. Trust

• Task: review forwarding and connect the observation explicitly to Trust.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.

A080. Security

• Task: describe recovery path and connect the observation explicitly to Security.
• Evidence: Record command, expected output, actual output, fingerprint or configuration line.
• Operations question: What happens on host-key change, wrong user, missing key or non-interactive CI execution?
• Security question: Can a private key, agent socket, tunnel, password login or bastion path be abused?
• Recovery: Describe revocation, rotation, known-hosts repair, key removal, CA change or log analysis.